Teleport Pro v1.29
[Reversing essay]

Subject: Cracking
Target: Teleport Pro v1.29
Author: BlackB
Date: 2000-05-09
Tools used: SoftICE, W32Dasm, HIEW
Difficulty (scale 1-5): 1
Before starting!
This essay is for knowledge purposes only!!
Software developers spend much time in making their programs. They live from the money we give them!
Please buy good software!!
I. Introduction
Easy essay on a useful program to download whole websites.
II. About the protection
Trial / Regular memory flag setting
III. Cracking it

Gonna be very short on this one because it's just too easy. Disassemble the program file (pro.exe) in w32dasm. If you run the program, click Help - About, the window 'll tell that it's unregistered. Search in the dead listing for "unregistered". You should see this:

Start partial code 
:004158AF 3899DB040000 cmp byte ptr [ecx+000004DB], bl 
:004158B5 7430 je 004158E7 
:004158B7 8945F0 mov dword ptr [ebp-10], eax 
* Possible Reference to String Resource ID=07037: "This copy of Teleport Pro is UNREGISTERED."

End partial code

Okay, pretty clear: our registered-or-not flag is located at ecx+4DB. Load the SoftICE symbol loader, load pro.exe, run it and when SoftICE breaks set a breakpoint on 4158AF. Let run the program until SoftICE breaks on the breakpoint. Type "d ecx+4db] to get the real adress of where the flag is stored. It should be 47DD8B. If the program is not registered, ECX+4DB should have '01' as value, bl should contain "0". To make the program believe it's registered
Exit the program, reload the program into SoftICE, run it again, when SoftICE breaks set a "bpm 47DD8B". This way SoftICE will break whenever a read or a write has been done to that location, providing us the information where we have to patch.
Write those locations down, search them in the dead listing and find their offsets. They should be:
4257B2, 4149F6, 415039, 41507D
To get their real offsets you have to substract the image base (or just look into w32dasm to get it).
Offsets are:
4257B2-40000=257B2
4149F6-40000=149F6
415039-40000=15039
41507D-40000= 1507D

Patch these locations in such a way that location [ESI+000004DB] contains zero (could also be [ECX+000004DB]). You'll have to use HIEW for this as it's the only hex editor in which you can insert direct assembly language.
When you patched all these locations and you run the program, you'll see that Teleport Pro detects when changes are made to the file (CRC-check). Look up the string in w32dasm and reverse the jump just before that string. Everything will be fine now.
The jump is at location 40B4D8 or offset B4D8.

There's one little detail left now: if you click Help - Register, the program 'll still make the registering option available. Set again a bpm on location 47DD8B (registered or not flag) then click Help - Register. SoftICE pops and you should see this:

Start of partial code

:00425300 3898DB040000            cmp byte ptr [eax+000004DB], bl
:00425306 752A                    jne 00425332
:00425308 3898DC040000            cmp byte ptr [eax+000004DC], bl
:0042530E 7522                    jne 00425332
End of partial code

Just NOP out both conditional jumps here and you're finished :) Not hard ;)
IV. In the end

Another essay finished. Greets goto all EVC members and ppl on #cracking4newbies.

Greets

BlackB

Endnote:
Essay written by The Blackbird © 1999-2000
This essay can be freely distributed/ published/ printed etc... as long as no modifications are made.