Subject: Cracking
Target: The Bat! v1.44
URL: http://www.ritlabs.com
Author: BlackB
Date: 2000-05-30
Tools used: SoftICE
Difficulty (scale 1-5): 2

Quite some time ago when I wrote my last tutorial. A good reason to explain a crack on a very good, actually: the best, email client available: The Bat!.
Some crackers familiar with earlier protection schemes of TheBat! may be wondering how I did this crack. For you guys, let me first tell you: they removed the ASProtect protection scheme! Why? I don't know for sure, but I think it's for two reasons:
1. Protection slows TheBat!
2. Protection is expensive, time robbing and get's cracked anyway.
I repeat: I'm just guessing, I don't know for sure.

Anyway, it's still an interesting program to crack (much easier though) and reverse a little bit, as I will with the draw window function ;)

All right. Run this program and see that a nagscreen appears, with a progression bar that shows how many days evaluations left. Also, the nagscreen has a 'Cancel' button and an 'OK' button.
The first difficulty of cracking this program is finding out where the jump to the nagscreen is, and where the nagscreen is drawn. I tried a lot of different breakpoints, but or they were called way too much or they weren't called at all! Then, after some long thinking I realised that as long as the nagscreen appears, it checks if the 'OK' button is pressed. That information is sent with the API SendmessageA! Run The Bat!, let the nag appear and set a breakpoint on SendMessageA.
SoftICE breaks. Press F12 a few times until you see this:

Start partial code

0137:0045CF49  CALL      0045E550 (1.)
0137:0045CF4E  MOV       EAX,[EBX]
0137:0045CF50  CMP       BYTE PTR [EAX+00000080],00 (2.)
0137:0045CF57  JZ        0045CF68
0137:0045CF59  MOV       EAX,[EBP-04]
0137:0045CF5C  MOV       DWORD PTR [EAX+00000134],00000002 (3.)
0137:0045CF66  JMP       0045CF7C
0137:0045CF68  MOV       EAX,[EBP-04]
0137:0045CF6B  CMP       DWORD PTR [EAX+00000134],00 (4.)
0137:0045CF72  JZ        0045CF7C
0137:0045CF74  MOV       EAX,[EBP-04]
0137:0045CF77  CALL      0045CCD0
0137:0045CF7C  MOV       EAX,[EBP-04]
0137:0045CF7F  MOV       EAX,[EAX+00000134]
0137:0045CF85  TEST      EAX,EAX
0137:0045CF87  JZ        0045CF47 (5.)

End partial code

Following notes were accomplished by doing some experimentation:
(1.) This is the call that is responsible for ALL window generation in The Bat!
(2.) Checks if Cancel button is pressed, if so, the next 'JZ' won't jump.
(3.) EAX+134 get's loaded with value '2', which means that the user pressed the cancel button and that the program should exit.
(4.) Checks if 'OK' button is clicked, if so, the next 'JZ' won't jump.
(5.) This is our jump that keeps looping until we clicked a button.

Just try it for yourself: put the value '01' in EAX+134 and let the program continue running: you'll see that the nag will disappear and that you can use the program. So what do you say: patch it? *Errrr* No :) This procedure is used for every window in whole the program. If we alter this, our whole program will get useless.
Let's find out where The Bat! makes the compare "Jump/Jump not to nag". Therefore, put value '01' in EAX+134. This is important as that value gets checked further on. Just reversing the jump won't do!
Okay, now trace further (eventually with F12 to speed things up), until you see this:

Start partial code

0137:005BA41B  CMP       BYTE PTR [00652F7C],00 (1.)
0137:005BA422  JNZ       005BA442
0137:005BA424  MOV       EAX,EBX
0137:005BA426  CALL      0053DDB0 (2.)
0137:005BA42B  TEST      AL,AL
0137:005BA42D  JZ        005BA442
0137:005BA42F  PUSH      00
0137:005BA431  PUSH      00
0137:005BA433  PUSH      10

End partial code

(1.) Is program registered? [00652F7C] contains 0 if unregistered, 1 if registered
(2.) This call draws our nagscreen.

This is the routine we have to patch......this way (with HIEW):

0137:005BA41B MOV BYTE PTR [00652F7C],01
0137:005BA422 JMP 005BA442

Make those changes with Hiew (don't forget to close The Bat! first), rerun it.....and see: it runs fine, even if you let it expire by setting your clock a month further!
So now you think (and I thought) it's cracked. However.....this program wouldn't be called The Bat! if there was another check. Fortunately it's almost exactly the same as explained above. The only 'difficulty' was finding the second check. To make things easier for you, it's triggered when you want to make a new account: Accounts - New.
The same nag appears. Use the same breakpoint (SendMessageA) to pinpoint the 'draw window' code and press F12 until you see it appear (just like we did before). And again, press F12 until we see our second 'registered or not check' which should look like this:

Start partial code

0137:005B24E2  CMP       BYTE PTR [EAX+13],00 (1.)
0137:005B24E6  JNZ       005B24F4
0137:005B24E8  MOV       EAX,[EBP-04]
0137:005B24EB  CALL      0053DDB0 (2.)
0137:005B24F0  TEST      AL,AL
0137:005B24F2  JNZ       005B2529
0137:005B24F4  CALL      0059CFF8
0137:005B24F9  TEST      AL,AL
0137:005B24FB  JZ        005B2529
0137:005B24FD  MOV       EAX,[0064BE2C]

End partial code

(1.) Checks if program is registered. If it is, the next 'JNZ' will jump
(2.) This is the call that draws our nagscreen

We'll patch this the same way as we did the first check:

0137:005B24E2 MOV BYTE PTR [EAX+13],01
0137:005B24E6 JMP 005B24F4

Voilà, done again! Hope you learned something.

Greets goto Risc and RED-1 (if you ever read this RED, you must feel pretty sick :P)

Greets,
The Blackbird