Subject: Cracking
Target: Fruity Loops v2.5
Author: BlackB
Date: 2000-04-24
Tools used: SoftICE
Difficulty (scale 1-5): 3

Hi there. It's some time ago I 've written a tutorial due to........lack of time. Been busy studying Armadillo protection scheme and some other cracking stuff to keep my cracking knowledge a bit updated :-)
Anyway, I was bored and another cracker (nicknamed Nitrus, hello btw if you read this ;) ) told he just cracked Fruity Loops v2.5 and that it wasn't very easy. So I thought: "Why not try it for myself". Well, it wasn't _that_ very hard, but it took me quiet some time before I've found it. Most of the time it's just a matter of looking at the good place.....in this case, I wasn't :-)

We won't bother unpacking it and trying to patch, as this would make it even more difficult (actually I don't know, but I suppose it is). No, we'll search for a serial this time :)
Install the prog, run it.....a dialogbox with two editboxes appears. First box will contain your username, the second one the serial. Go ahead and fill in some bogus stuff (i.e. random data). Then fireup SoftICE (ctrl-d) and set a breakpoint on hmemcpy. Click on the "V" sign and SoftICE should popup.
Clear all breakpoints (bc *) and press F12 twelve times to get into the main program. The whole serial creation routine looks like this:

Start partial code

0137:004EEBC6  MOV     EAX,[EBP-0C]
0137:004EEBC9  LEA     EDX,[EBP-08]
0137:004EEBCC  CALL    004080EC
0137:004EEBD1  MOV     EAX,[EBP-08]
0137:004EEBD4  LEA     EDX,[EBP-04]
0137:004EEBD7  CALL    005012E0 (1.)
0137:004EEBDC  MOV     EDX,[EBP-04]
0137:004EEBDF  MOV     EAX,[005273E0]
0137:004EEBE4  CALL    00403D3C
0137:004EEBE9  XOR     EDX,EDX
0137:004EEBEB  MOV     EAX,ESI
0137:004EEBED  CALL    00423014
0137:004EEBF2  MOV     EBX,[EBX+000001EC]
0137:004EEBF8  LEA     EDX,[EBP-0C]
0137:004EEBFB  MOV     EAX,EBX
0137:004EEBFD  CALL    00422FE4
0137:004EEC02  MOV     EAX,[EBP-0C]
0137:004EEC05  LEA     EDX,[EBP-04]
0137:004EEC08  CALL    005012E0
0137:004EEC0D  MOV     EDX,[EBP-04]
0137:004EEC10  MOV     EAX,[005270B8]
0137:004EEC15  CALL    00403D3C
0137:004EEC1A  XOR     EDX,EDX
0137:004EEC1C  MOV     EAX,EBX
0137:004EEC1E  CALL    00423014
0137:004EEC23  CALL    00501B04 (2.)
0137:004EEC28  CALL    00501734 (3.)
0137:004EEC2D  MOV     EAX,[00526FDC]
0137:004EEC32  CMP     DWORD PTR [EAX],00
0137:004EEC35  JNZ     004EEC46
0137:004EEC37  MOV     EDX,00000030
0137:004EEC3C  MOV     EAX,004EEC80

End partial code

I can assure you, that if you have to trace into all those calls, and in the calls _in_ the calls, you'll be working for a very very long time! (I did) Your eyes will get dry, you'll start to see orange rabbits, ......anywayz, I'll give you a brief explanation of the calls that do the most important things. They're blue-coloured.
In call (1.) our username and serial gets encrypted using the following algorithm:

Start partial code

0137:0050133A  MOV     EAX,[ESI] [<- Move username into EAX]
0137:0050133C  MOVZX   EAX,BYTE PTR [EBX+EAX-01] [<- Put first letter into AL]
0137:00501341  ADD     EAX,00000258 [<- AL=AL+258]
0137:00501346  SUB     EAX,60 [<-AL=AL-60]
0137:00501349  SUB     EAX,EBX [<-EBX==1, then 2, then 3, until EBX==length username]
0137:0050134B  MOV     ECX,0000004B [<- Put 4B into ECX]
0137:00501350  CDQ
0137:00501351  IDIV    ECX [Divide EAX with ECX and put the rest of division into EDX]
0137:00501353  ADD     DL,30 [<- DL=DL+30]
0137:00501356  POP     EAX [<- Restore username]
0137:00501357  MOV     [EAX],DL [<- Put encrypted char into [EAX]]
0137:00501359  INC     EBX [<- Increase our counter]
0137:0050135A  DEC     EDI [<- Decrease the length counter]
0137:0050135B  JNZ     0050131E [<- If not all chars of username are encrypted: repeat]

End partial code

My nickname "BlackB" looks like "\:yz6W" after encryption. The same is done with your serial.

Okay, in call (2.) our encrypted username and serial get written into c:\windows\ilrc.src (set a breakpoint on writeprivateprofilestringa to find out). Also an additional serial gets written into that file. Here u can see how the file looks (please note that there's no valid file is printed here, just an example)

[ILRC]
FL_NC=EncryptedusernameEncryptedserial
FL_SN=341120984

So far so good :) Now comes the part with most work: the creation of the real serial and the check. I will not (and can not) explain this in much detail as there's only one advice and method I can give if you really want to understand _everything_ of this whole routine:: trace into every call you encounter! The serial is created in call (3.) .Trace into that call until.........

Start partial code

0137:005017D0  ADD     EAX,1D [<- Add 1D to the length of your serial]
0137:005017D3  CMP     EAX,27 [<- If serial is not 10 chars long then...]
0137:005017D6  JNZ     00501800 [<- Jump to bad boy]
0137:005017D8  LEA     EDX,[EBP-0C]
0137:005017DB  MOV     EAX,[EBP-04] [<- When you executed this instruction type 'd eax']
0137:005017DE  CALL    00501428 [<- Create real serial, you'll see it appear in the data box]
0137:005017E3  MOV     EDX,[EBP-0C]
0137:005017E6  MOV     EAX,[EBP-08]
0137:005017E9  CALL    00404074
0137:005017EE  SETZ    AL [<- If serial 's okay, AL==0]

Thx goto Nitrus for giving me this program, and for giving me a little hint :-)
Additional greets goto MMke, R!sc, Neural "Newral" Noise and Lazarus
Hope you enjoyed this tutorial, keep on reversing and cya!

Greets

BlackB