| | ||
| Thereis a crack, a crack in everything. That's how the light gets in. |
Make sure you havethis highlightedline included with the rest of these lines in your Winice.dat file whichis located in your Softice directory .
Winice.dat filecan be opened for editing using NotePad.
EXP=C:\windows\system\kernel32.dll
EXP=C:\windows\system\user32.dll
EXP=C:\windows\system\gdi32.dll
EXP=C:\windows\system\comdlg32.dll
EXP=C:\windows\system\shell32.dll
EXP=C:\windows\system\shell232.dll
EXP=C:\windows\system\advapi32.dll
EXP=C:\windows\system\vb40032.dll
EXP=C:\windows\system\msvbvm50.dll<<--- make sure that this .dll file is listed in your winice.datfile. Make sure that there are NO "; " (semi-colons) in front of these statements or the file will not beread.
Of course youwill want to make sure that the path above is also correct and matchesthe path that your file is actually 'housed' in...! C:\windows\system...ect...
2. Next, reconfigure the Alt-F4 key and re-program it so that it will automatically locate the EXACTVisual Basic sub-routine that compares our entered serial number againstthe one the target program expects us to use.
While still editing Winice.dat locate theline starting with AF4="^and REPLACE it with thehighlighted line shown below.
F1="h;"
F2="^wr;"
F3="^src;"
F4="^rs;"
F5="^x;"
F6="^ec;"
F7="^here;"
F8="^t;"
F9="^bpx;"
F10="^p;"
F11="^G @SS:ESP;"
F12="^p ret;"
SF3="^format;"
CF8="^XT;"
CF9="TRACE OFF;"
CF10="^XP;"
CF11="SHOW B;"
CF12="TRACE B;"
AF1="^wr;"
AF2="^wd;"
AF3="^wc;"
AF4="^s 0 l ffffffff56,57,8b,7c,24,10,8b,74,24,0c,8b,4c,24,14,33,c0,f3,66,a7;"
AF5="CLS;"
AF8="^XT R;"
AF11="^dd dataaddr->0;"
AF12="^dd dataaddr->4;"
CF1="code on; altscr off; lines 58; wc33; wd 8; wr; wl; ww 2; faults off;"
CF2="^wr;^wd;^wc;"
The above lines assignscommonly used Softice commands to some of your function keys, this savesa lot of typing on your part if you can execute a whole sequence of commandsjust by press two keys together. Now the new ALT-F4 function willsave you from having to type:
s 0 l ffffffff56,57,8b,7c,24,10,8b,74,24,0c,8b,4c,24,14,33,c0,f3,66,a7
every time you wishto locate the VB routine that compares two strings together.
This command simplytells Softice to search for a unique sequence of 19 bytes starting frommemory location 0 all the way to the maximum amount of memory installedon your pc. These bytes form just a part of the VB routine we're interestedin and have to include this number of bytes because there are other verysimilar routines to the one we're interested in and this way we can besure that the VB routine Softice finds is the right one.
Now save your winice.datfile. Make sure you make a backup first just in case you make anymistakes.
That's it!.
Run the program Cconvert.exe...a box appears saying you're unregistered; click okay; now select the'about' and then the "Register" button.
Type in your Name/Handlethen a random sequence of numbers into the Registration box.
Before going anyfurther press CTR-D tofire up Softice and then type: bpx hmemcpy. Now type X toleave Softice.
OK, now you can clickon the 'Validate' button...
Softice breaks atthe beginning of the HmemCpy sub-routine.
Now we want to quicklyfind the routine that compares our serial number with the *real* one andwe can do this effortlessly by pressing the ALT-F4keys together.
Softice should nowreport back a first memory location of where the sub-routine were lookingfor is to be found in memory. In mycase Softice reported:
Pattern found at: 0030:0F00D9EA --<-This address maybe different on your puter
Now type: ufollowed_by_the_memory_address_just_given_by_Softice
In my case I type:u 0030:0F00D9EA
Softice shouldnow display this code snippet:-
: 56 push esi <<<---you land here;this is where you will set a new breakpoint.
: 57 push edi
: 8B7C2410 mov edi, [esp + 10]
: 8B74240C mov esi, [esp + 0C]
: 8B4C2414 mov ecx, [esp + 14]
: 33C0 xor eax, eax
: F366A7 repz cmpsw
: 7405 je 0F79B362
: 1BC0 sbb eax, eax
: 83D8FF sbb eax, FFFFFFFF
: 5F pop edi
: 5E pop esi
: C20C00 ret 000C
Ok, from here type:
Example: bpx followed_by_the_memory_address_just_given_by_Softice
In my case I type:bpx 0030:0F00D9EA. I have found that in order to get the above address yousometimes must type 's' to do another search until you have found the aboveline #. You also can double click on the line 0030:0F00D9EA, instead of typing it in, toset the breakpoint...
Lastly, type: bd00 to disable our original hmemcpy breakpoint,we don't need it anymore and finally, typeX to leave Softice.
Softice now breaks again, this time onour newly created breakpoint,
: 56 push esi <<<---we land here
: 57 push edi
: 8B7C2410 mov edi, [esp + 10]
: 8B74240C mov esi, [esp + 0C]
: 8B4C2414 mov ecx, [esp + 14] <<<--F-10to here;
<<<< type "decx"...the real serial will
<<<< be displayed...
<<<< typing "desi"; the line above; and
<<<< this will display your fake # input.
: 33C0 xor eax, eax
: F366A7 repz cmpsw
: 7405 je 0F79B362
: 1BC0 sbb eax, eax
: 83D8FF sbb eax, FFFFFFFF
: 5F pop edi
: 5E pop esi
: C20C00 ret 000C
Our registrationcode will be in Wide Character Format, which simply means that insteadof our Registration/Serial number looking like "GypsyJoker" it will now look like: "G.y.p.s.y.J.o.k.e.r" instead. Other than that it's stillthe REAL serial number.
In this case Violatily has mixed lettersand Numbers; and the code for my input was:
User Name: jasman <<<---I usuallyuse "jas" but lately the user name has been "length" sensitive..I justmay have to get myself a longer handel...
Registration Code: "XXX-2120-XXXX"<<<---Where "X" is a hard coded partof this Reg code and for which I'll not publish.
Ya'all will see it if you followthe guidelines above...
The numerical part of this reg is generatedby a part of your user name input.....I'll leave that for you to figureout also...
CONGRATULATIONS!
BUSTED this dude!
If you now type bd *, to clear all breakpoints,and re-open the program and type in a new name and reg #; ctrl-d; and typein "be 00",(our hmemcpy bpx #); and then x to leave;ice will now POP and will immediately show in thedata window the new reg code for the new name you used......withouthaving to re-search any code at all.....:)
Okay; I must explain a little: SOMETIMESthis works; at other times I must hit x ; enter; x; enter; x, enter, tilthe "Sorry" error box appears; now hit your 'x' and enter key once moreand the new Username and new reg key will be displayed in data window withouthaving to go back inside any code!!!
Are we done?
Some will be...
if they are only interested in 'the' crack.;but for those of you who have just used this Alt-f4 key combo on some otherVB program that will not break to bpx 0f00d9ea...stick around...more tocome...
#1 Sometimes thebpx 0f00d9ea simply will not return to your set breakpoint to enable youto view this code.
#2 Sometimes thebreakpoint will break and you will find and see a legitimate lookingcode displayed; but when you enter it, it brings back an error "bad reg"statement. DON'T let this fool you! This code , in most cases, is the correctcode; but it simply needs some more work; albeit, a xor routine somewherein the code that you will have to find and convert.
#1By following the next two examples you can increase your chances of findinga correct code when alt-f4 key doesnot produce.
I came in the backdooron this one by stepping thru the 0f00d9ea call; when we do so, we returnto this area: MSVBUM50!__vbastrcomp
014f:0f003563...55...pushebp...
So checking severalprograms that would not break-back to the alt-f4 key I found if I set abreakpoint at:bpx __vbastrcomp instead; that I was enabled to break back;and interesting; your code lies here also.
Try this:
Using VolatilitiesCConvert program; fill in the Reg and name key, set a bpxhmemcpy in ice; x;hit the Validate button;ice pops; type bd 00to disable your hmemcpy break; and now type bpx__vbastrcomp;x; ice flashs and pops back into ice... (notehere that the __ <<--areTWO underscores together!)
You will land here:
MSVBUM50!__vbastrcomp
014f:0f003563 55 push...ebp <<--landhere
014f:0f003564 8bec mov ebp, esp
F-10 down to
014f:0f003564 8bec mov ebp, esp <<--type'd' esp here
now if you arenot already running your data window in this mode:
type dd esp.
Your data windowwill now look like this:
0157:0064f250......0064f2c4......0f00461b......00000000.....00424798........d..f......GB
0157:0064f260......00424750......0f100640......00000000......00424798......PGB.@....GB
Notice the fourthstack; 00424798
now type 'd'00424798....this reveals the Real Code
curious as to the#.00424750 infirst stack; second line:
I typed'd' 00424750....this is your fake #......
If you continueto step thru this routine in this way you will continue to find half amillion references to your fake and real code being revealed.
Also I found somethingrepeated in some programs;
If you step downto line # 014f:0f00358f...jae 0f0035b6...it wants to jump here to 0f0035b6
By typing r eip=0f003591
You will be allowedto step to the next line down and at 10 more lines down you arriveat...
0f0035a6...call0f00d9ea
(Do you recognizethis #?)
Yep; our alt-f4 routine;
step into it (f-8)and explore...
Where will it returnus too? Yep; the MSVBUM50!__vbastrcomp check. Hummmm; I wonder where tracingbackwards from here would take us? Are we done?
Nope!
Fourth Approach:
.
As I say; none ofthese proceedures are infalable; I have tried to explore many VB programsto find a difinite pattern that we could follow and sometimes one or theother of these work out but never... ALWAYS...
So here is anotherapproach when the above fails...
Once again fill inall information and bpx hmemcpy; x to leave; hit Validate button; ice pops;F-11 once; and now f -12 thirteen times;
(Note: this numberis consistant with every VB program I tried; it is always 13 f-12's;unless you have a greyed out button and type in an extra # to pop hmemcpy;then the #of f-12's changes) Now you will land in MSVBUM50 dll...and on a RETinstruction;
F-10 into this Ret.You will now land inside of the program code.
Step down to line# 014f:0040ac84...mov...ecx...[ebp-58]
type: ddesp; to change the data window.
Now type 'd'ebp-58
you will see this:
00424774......00000000......000d1626......1b0c005......
Now just type: 'd'00424774...
you'll see your username and just below this you will see your real code: Now this proceedureis not consistant AT this paricular line,not always; in this case the realcode was revealed to us in the data window; BUT often you must continuestepping thru this code area continuing to check your various registersto find the real code; ...so far I have been fortunate and have found 7out of 12 in this way in my test of this proceedure...
Are we done?
Nope!
Not unless you are!
Fifth Proceedure:
I have found thisproceedure, when it works out; to be most powerful! VB uses the followingAPIs to manipulate strings:
multibytetowidechar
widechartomultibyte
Heres what we aregoing to do this time.
Okay; fire up Ice:
type the followinglines very carefully in the ice input window!
This will be thehardest to follow so pay attention...:)
bpx multibytetowidechardo "d * (esp+4*3)"
bpx widechartomultibytedo "d * (esp+4*3)"
Okay; once you haveup these two breakpoints then open up Cconvert... Ice will immediatelybreak. Now this varys from program to program so you will have to watchwhat happens in your data window; In Cconverts case we are going to usethe f-5 key to step thru the loading and converting of your input. Now f-5 (50) times until the Unregistered Version box pops; press the okaybutton; Volatilitys Unregistered program is displayed. Now click on theAbout button.
ICE will pop; 16f-5's will pop the About-Register box .
Click onRegister button.
Fill in the User-nameand Registration Code Areas.
Click the Validatebutton.
Ice will pop :
Your code windowwill show that you are at
Kernel32!multibytetowidechar& Kernel32!widechartomultibyte
In your data windowyou will see your Username; Now f-5 until you see your fake serial # inputin the data window. When you see your fake # displayed type: ddesp
This will changethe appearance of your data window.
You will see fourstacks of numbers:
0f0414e2.....00000000......00000000......00d9e4dc
typing: d00d9e4dc reveals our fake #
Now type: d 0f0414e2...and press F-11 key
Your code windowhas now changed; you are here:
0f0414dc.....call...Kernel32!multibytetowidechar
0f0414e2......mov......ebx,eax.....<<<--land here
Now watching yourdata window...
continue to f-5 untilyou SEE the "Sorry; You no good excuse for a cracker" message
Here you will alsosee that your code has been processed and is displayed in the data window.
You might have toscroll up a line or two.
I checked this on4 VB programs and although the number of f-5's change; basically this sameformat works for those I checked ...except for two... Those two exceptions(so far) hung up and simply continued to go on and on and on once I sawthe reg box pop behind ice window; and so I simply control-d-ed back toice; bd *; my two bpx multi statements; THEN I x-ed out; filled in theReg box; cntrl-d back to ice; BE 00 & BE 01 to re-enable the two bpxs;x-ed out; hit reg key; and then kept f-5-ing to the next step of proceedureabove...
Procedure done.
I would like to congratulate Volatiltyfor producing one of the greatest teaching programs anyone could have writtenfor teaching the many ways VB could be attacked and handeled.
As we have learned at the Sandmans projectssite @ http://disc.server.com/Indices/33330.htmlthe crack is not done until the cracker ' knows' his crack.
My thanks and gratitude goes to:-
The Sandmanfor providing possibly the greatest source of Reverse Engineering knowledgefor newbys on the Web; and who toldme to never give up when VB was strangeling me.
Special thanks go to Crackz; Prophesy,for their great tutes; to Volatility; and BornaJanes who wouldn't let megive up. And to my great internet compadre', twno,who forever teaches and watches over me.:) and also to D0gbytes who candrink me under the table at virtual whiskey sites...:)
And to all those of you who write and teachme each day, no matter your depth of knowledge.
Ripping off software through serialsand cracks is for lamers..
If your looking for cracks or serialnumbers from these pages then your wasting your time, try searching elsewhereon the Web under Warze, Cracks etc.
Formore info. on this type protection and set-up Goto the Sandmans' Essays#59 & #63
| [ Return] |