Getting ready for the next Millenium

WS_FTP Pro 6.02 Eval

[Reversing essay]

Subject: Cracking
Target: WS_FTP Pro 6.02 Eval
URL: http://www.wsftp.com
Author: BlackB
Date: 1999-11-02
Tools used: SoftICE, W32DSM89, HIEW
Difficulty (scale 1-5): 2 à 3
Requirements: Average cracking knowledge

Before starting!
This essay is for knowledge purposes only!!
Software developers spend much time in making their programs. They live from the money we give them!
Please buy good software!!

I. Introduction

Yeah, another essay! This time on how to crack the WS_FTP Pro 6.02 Eval. I just love the program, rather than CuteFTP
or any other FTP program. It's easy to use, not that big...in one word: great!
First day I tried to crack it I gave up and removed it from my harddisk. But next day I woke up and I realised that I used a
wrong approach. So I reinstalled it, started cracking and the job was done in less than 20 minutes. ;-)
Now before you start the essay, first this: this essay learns you how to crack the ws_ftp main program...not how to crack the
Explorer interface (an util I never use btw) and also not how to crack the ftp finder util! (however it's dead easy)

II. About the protection

Nag/ trial

III. Cracking it

Every time you run ws_ftp it displays a nagscreen. It shows you how many days you have left 
and also when it's going to expire. Setting your clock a month later will show you the 
nagscreen again, but you can only click the "Buy now" and "Quit" button. Setting the clock 
back will re-enable your trial period.

Disassemble the ftp95pro.exe and save the dead list. When looking to the string references you won't see anything of what is
displayed on the nagscreen. I found out that all strings of that nagscreen are located in the file ws_ftp.key . This file 's probably
also used in the registered version, but it may contain your registration info instead. Anyway, I monitored ws_ftp's behaviour
with FileMon and the ws_ftp.key file is called about a thousand (!) times...impossible to find out what, how, and where about
it. So our cracking approach will be: 1. Removing the nagscreen 2. Removing the 30 day trial.

For removing the nagscreen I developed myself a new method (it probably already exists, but I never 've read it in an essay).
The concept: break SoftICE somewhere in the program BEFORE the nagscreen is drawn. Step over very call you encounter
and look if the nagscreen is drawn (you can do that with F4). Once the nagscreen appeared, clear all breakpoints, and set a
new breakpoint on the call that let appear the nag. Exit SoftICE, quit the program, restart the program....SoftICE will break
on the call that draws the nagscreen.
Trace into the call, then step over all calls until the nagscreen appears, clear all breakpoints, set a new breakpoint on the call
that let appear the nag, etc etc.... . Do this until you 've found the "call nag" procedure. Confused? Here 's a scheme:

call xxxxxxxx
...
instructions
...
call xxxxxxxx (nag appears)
...             |
              trace--push ebp
...                  ...
                     instructions
                     ...
                     call xxxxxxxx (nag appears)
                     ...             |
                                   trace--push ebp
                     ...                  ...
                                          instructions
                                          ...
                                          call xxxxxxxx (real nag procedure)
                                          ...

For the ones who still don't get it: the only thing you do is refining. You could NOP out the first call that draws the nag, but
that call probably contains other valuable code for the program. So that's why you have to trace into the call and search there
for another call that draws the nag....until you can't refine anymore and then you've found the real nag routine. If still not clear,
just follow how I cracked the prog ;-)

Our first problem is finding a good place to set a breakpoint on. A good place= a place not too far from where the nagscreen
is drawn. Remember that I said that the text on the nag can be found in the file ws_ftp.key? Well, let's search for that in the
dead listing!