Subject: Cracking
Target: Planet Zip 5.05
Author: BlackB
Date: 1999-03-04
Tools used: SoftICE, W32DSM89, HIEW 6.01
Difficulty (scale 1-5): 1
Requirements: Basic knowledge of cracking and some inspiration

Okay, so here's the tut you asked for. The program wasn't very easy, but 
also not very hard to crack. I'll try to be as clear as possible.....

30-day trial / 30 trial uses / nag

The program's protection is a 30 day trial, 30 trial uses and a nag. It
provides the possibility to enter a key, but i felt it would take longer
finding the key than crack it with w32dsm. The approach i used for this
program is letting it believe it is registered, so it won't display the
nag anymore, and won't expire when exceeded the trial! :-)
Okay, start Planet Zip, click on "Enter registration code" and enter a bogus
number. Click ok. It displays: "Incorrect registration data". Keep this
string in mind!
Now open w32dsm and disassemble the prog. Click on the "Strn Ref" button and
search for the string "Incorrect registration data". Double click on it :)
Okay, u should see this:

------------------------Start-of-partial-code--------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0045CAD2(C), :0045CAFB(C), :0045CB24(C), :0045CB4B(C) <- Hmmmm, 4 calls!
|
:0045CBE1 6A00                    push 00000000
:0045CBE3 668B0D40CD4500          mov cx, word ptr [0045CD40]
:0045CBEA B201                    mov dl, 01

* Possible StringData Ref from Code Obj ->"Incorrect registration data."
                                  |
:0045CBEC B84CCD4500              mov eax, 0045CD4C
------------------------End-of-partial-code----------------------------------

As you can see, this piece of code is called 4 times. 
In w32dsm click on "Goto" then "Goto code location" and enter the first
call: 0045CAD2.
You should see this:

------------------------Start-of-partial-code--------------------------------
:0045CACD E80647FAFF              Call 004011D8
:0045CAD2 0F8509010000            jne 0045CBE1 <- Aha! A conditional jump :))
:0045CAD8 8D45E4                  lea eax, dword ptr [ebp-1C]
:0045CADB 50                      push eax
------------------------End-of-partial-code----------------------------------

That looks very very suspicious....but wait there are still 3 other places
where a "jump" should appear......so check out the other 3 locations. They
should look like this:

Location 2
:0045CAF6 E8DD46FAFF              Call 004011D8
:0045CAFB 0F85E0000000            jne 0045CBE1

Location 3
:0045CB1F E8B446FAFF              Call 004011D8
:0045CB24 0F85B7000000            jne 0045CBE1

Location 4
:0045CB43 E87046FAFF              Call 004011B8
:0045CB48 83F803                  cmp eax, 00000003
:0045CB4B 0F8E90000000            jle 0045CBE1

To crack the program, and let the program believe you've entered the right
key, you have to NOP all those conditional jumps. The hex code for NOP is 90
but i hope you already knew that. Open your favorite hex editor and NOP 'em
all! :-)

When you're done, run Planet Zip, enter a registration code.....and yups
it is successful! Everything seems fine. Now exit Planet Zip, and restart
it. Damn!! It still displays the nag and it says it isn't registered.
Okay, so there has to be a file or registery key where the registration
code is stored, so Planet Zip can check it every time you run it.

In this case it is a registery key called "Reg Code". How I know? Well, 
as a cracker you should have Regview, a great registery editor, and i use
it to see what registery keys a program adds. However, i won't explain now
how u can find that key, or how to work with Regview. If you want to know
just ask me some time :-)

Okay so let's see if the string "Reg Code" is in the dead listing :)
Re-open w32dsm and open your previously saved textfile (i hope you did!)
of Planet Zip. Search for the string "Reg Code".
Okay! Found!

------------------------Start-of-partial-code--------------------------------
* Possible StringData Ref from Code Obj ->"Reg Code"
                                  |
:0044E5CC B900E74400              mov ecx, 0044E700
:0044E5D1 33D2                    xor edx, edx
:0044E5D3 8B45F8                  mov eax, dword ptr [ebp-08]
:0044E5D6 E8E943FBFF              call 004029C4
:0044E5DB 8B45F0                  mov eax, dword ptr [ebp-10]

* Possible StringData Ref from Code Obj ->"GMA 17195 3112"
                                  |
:0044E5DE BA14E74400              mov edx, 0044E714

* Reference To: VCL30.System.@LStrCmp@51F89FF7, Ord:0000h
                                  |
:0044E5E3 E8F02BFBFF              Call 004011D8
:0044E5E8 7510                    jne 0044E5FA <- nothing interesting here
:0044E5EA 8B45FC                  mov eax, dword ptr [ebp-04]
:0044E5ED 8B80E8010000            mov eax, dword ptr [eax+000001E8]
------------------------End-of-partial-code----------------------------------

Now i'll explain what i'm actually looking for: When a program is registered,
it almost ALWAYS sets a flag. In many cases it sets a register or memory
location to "1". So if you can find any "mov eax, 0000001" the chance 'll be
great. Of course there are many "mov eax, 00000001" in a program, so I look
for them not far from where a registery key has been read. If you don't 
understand what i'm saying here.....don't panic....you'll understand :-)
Let's go on....

So, I was saying that the "jne 0044E5FA" instruction was not interesting
becoz if you jump to that location there is no suspicious memory setting.
Okay.....then there has to be another "Reg Code" string.......press
F3 in w32dsm to search for a next "Reg Code" string.
Yups! Found one again! :-))

------------------------Start-of-partial-code--------------------------------
* Possible StringData Ref from Code Obj ->"Reg Code"
                                  |
:0045CBA4 B9D4CC4500              mov ecx, 0045CCD4
:0045CBA9 33D2                    xor edx, edx
:0045CBAB 8B45F0                  mov eax, dword ptr [ebp-10]
:0045CBAE E8195EFAFF              call 004029CC
:0045CBB3 8B45F0                  mov eax, dword ptr [ebp-10]

* Reference To: VCL30.System.TObject.Free@23EDC2EF, Ord:0000h
                                  |
:0045CBB6 E82545FAFF              Call 004010E0
:0045CBBB 6A00                    push 00000000
:0045CBBD 668B0DE0CC4500          mov cx, word ptr [0045CCE0]
:0045CBC4 B203                    mov dl, 03

* Possible StringData Ref from Code Obj ->"Thank you for purchasing Planet.Zip."
                                  |
------------------------End-of-partial-code----------------------------------

Again not interesting becoz there's even no conditional jump! Also, the
2 calls don't point at anything interesting. Press F3 again......

------------------------Start-of-partial-code--------------------------------
* Possible StringData Ref from Code Obj ->"Reg Code"
                                  |
:004625BA B96C264600              mov ecx, 0046266C
:004625BF 33D2                    xor edx, edx
:004625C1 A1E47F4800              mov eax, dword ptr [00487FE4]
:004625C6 E8F903FAFF              call 004029C4
:004625CB 8B45F8                  mov eax, dword ptr [ebp-08]

* Possible StringData Ref from Code Obj ->"GMA 17195 3112"
                                  |
:004625CE BA80264600              mov edx, 00462680

* Reference To: VCL30.System.@LStrCmp@51F89FF7, Ord:0000h
                                  |
:004625D3 E800ECF9FF              Call 004011D8 <- checks registration code
:004625D8 745F                    je 00462639 <- This jump is interesting!!

------------------------End-of-partial-code----------------------------------

Aha, that's what we were lookin' for! What do you think of this hypothesis:
Planet Zip reads and compares the registery key in the "call 004011D8".
If the reg code is good, then jump to 00462639! And oh god....if we
look at code location :00462639 we see....

------------------------Start-of-partial-code--------------------------------
:00462639 8B45FC                  mov eax, dword ptr [ebp-04]
:0046263C C6800104000001          mov byte ptr [eax+00000401], 01
						    |	
Hey, didn't i told ya! eax+401 is set to 1 here! ---|

------------------------End-of-partial-code----------------------------------

The last thing we have to do is making the program ALWAYS jump to 0046263C,
by changing the "je 00462639" in "jmp 00462639". Therefore you have to 
change the hex instruction "745F" in "EB5F". Do so!

Now run Planet Zip and it's cracked!

Btw, I think it wasn't really necessary to NOP all those beginning 
conditional jumps......but when you're busy crackin' you can't actually
know :-)

Enjoy the prog.....mail me at cracking@softhome.net 
And btw, it wasnt necessary to change the conditional jumps.....but it's useful to know 
how i worked, even if it's wrong :-)

BlackB