New 2 Cracking
~~~~~~~~~~~~~~

Tutorial Type  : Tutorial
Tutorial Topic : Keygen Injection on FaNt0m's CrackMe #4
Writen by      : ParaBytes
Date           : Jan. 31th, 2002.
Music          : None
Utilities      : Snippet Creator/MASM/W32Dasm/Brain/Some ASM Knowledge/ExEScope
Remarks        : This tutorial will show you how to make the crackme 
                 into its own keygen, assuming that like me, you dont really know
                 how to mess with the PE Header and the empty places...


Ok, now, lets roll...

After a long time i had a 'dry season' soon, new tutorials will start poping up...
Keyegn Injection is making a program into its own keygen,
if the checking algo is not by cmp/xor/lstrcmp/etc... you need to add code that
actually works like a keygen, but, 
because i (and i assume you to) have no deep knowledge on how to add code without
ruin the exe structure, i'll use Snippet Creator (by Iczelion), that you can get on
protools, to add new section and the code we need in side it...

lets roll...
open the crackme in w32dasm (you can get the crackme in http://fant0m.cjb.net just to mention)
go with the SDR (String Data Reference) to the message that asys, all good...
scroll up couple of lines, you see :

:00401205 6800010000              push 00000100                  // push length of string to capture
:0040120A 6884304000              push 00403084                  // push Name address in mem

* Possible Reference to Dialog: MAINDIALOG, CONTROL_ID:03E8, ""  
                                  |
:0040120F 68E8030000              push 000003E8                  // Push DlgItem ID
:00401214 FF7508                  push [ebp+08]                  // Push hWnd

* Reference To: USER32.GetDlgItemTextA, Ord:0102h
                                  |
:00401217 E862010000              Call 0040137E                  // Get Our Name
:0040121C 6800010000              push 00000100                  // push length of string to capture 
:00401221 6884314000              push 00403184                  // push Serial address in mem

* Possible Reference to Dialog: MAINDIALOG, CONTROL_ID:03E9, ""  
                                  |
:00401226 68E9030000              push 000003E9                  // Push DlgItem ID
:0040122B FF7508                  push [ebp+08]                  // Push hWnd

* Reference To: USER32.GetDlgItemTextA, Ord:0102h
                                  |
:0040122E E84B010000              Call 0040137E                  // Get Our Serial
:00401233 FF7508                  push [ebp+08]                  // push hWnd (donno why >:))
:00401236 E8BE000000              call 004012F9                  // check if our serial is good
:0040123B 83F800                  cmp eax, 00000000              // return=0 ?
:0040123E 7415                    je 00401255                    // bad serial !
:00401240 6A40                    push 00000040                  // else, start the good messagebox

* Possible StringData Ref from Data Obj ->"Check Serial"         // good message.. bla bla bla

and so... on...

ok,
we have the address for name & serial and we know what we should do....
so, 1st of all, i'll explain how i knew that the 1st GetDlgItemText was the name,

open the crackme in ExeScope, goto Resource > Dialog > MAINDIADLOG
select View > Dialog Editor
now, you see the dlg, as is, select the name Edit Box, you'll see that the ID is 1000 (3E8h)
and the Serial Edit Box ID is 1001 (3E9h)

so this is how i knew what is taken each time...

so, lets go into the call

we see

:004012FE 8D3584304000            lea esi, dword ptr [00403084]
:00401304 8D3D84324000            lea edi, dword ptr [00403284]

well, look up (in the tutorial) what address was taken for name ?
that right, 00403084,
now lea register, address memory will move the address into the register,
so 

lea esi, dword ptr [00403084]

is actually,

mov esi, 00403084

same goes with edi, but we never saw that address before, must be the good serial adderss, 
00403284, we have is written, now lets go on

:0040130A 33C0                    xor eax, eax                       // eax=0
:0040130C 33C9                    xor ecx, ecx                       // ecx=0
:0040130E B31A                    mov bl, 1A                         // bl=1A (26 decimal)

* Referenced by a (U)nconditional or (C)onditional Jump at Address:  // the loop from
|:00401328(U)                                                        // 00401328
|
:00401310 803E00                  cmp byte ptr [esi], 00             // the current byte=0 ?(end of name)
:00401313 7415                    je 0040132A                        // if do, jmp out of the loop
:00401315 8A06                    mov al, byte ptr [esi]             // al=current letter of name
:00401317 02C1                    add al, cl                         // add the letter place on str -1
:00401319 32C1                    xor al, cl                         // xor it with the same value
:0040131B F6F3                    div bl                             // divide with 1A
:0040131D 66C1E808                shr ax, 08                         // shr ax,08 = ah = al, 
:00401321 0441                    add al, 41                         // al=al+41h  
:00401323 8807                    mov byte ptr [edi], al             // this is the letter of serial
:00401325 47                      inc edi                            // next letter in serial
:00401326 46                      inc esi                            // next letter in name
:00401327 41                      inc ecx                            // inc counter
:00401328 EBE6                    jmp 00401310                       // goto loop start

* Referenced by a (U)nconditional or (C)onditional Jump at Address:  // exit from loop, name is over
|:00401313(C)                                                        // came from 00401313
|
:0040132A C60700                  mov byte ptr [edi], 00             // add NULL to end of serial
:0040132D 33C0                    xor eax, eax                       // eax=0
:0040132F 83F900                  cmp ecx, 00000000                  // name length was 0 ?
:00401332 741A                    je 0040134E                        // if do, go away..
:00401334 6884324000              push 00403284                      // good serial
:00401339 6884314000              push 00403184                      // hey ! its the fake serial address

* Reference To: KERNEL32.lstrcmpA, Ord:02D6h                    
                                  |
:0040133E E8A1000000              Call 004013E4                      // cmp the serials
:00401343 83F800                  cmp eax, 00000000                  // eax=0 (strings are equal)
:00401346 7404                    je 0040134C                        // goto set good return
:00401348 33C0                    xor eax, eax                       // else, eax=0
:0040134A EB02                    jmp 0040134E                       // goto end of funtion

* Referenced by a (U)nconditional or (C)onditional Jump at Address:  // here we set the good stuff
|:00401346(C)
|
:0040134C 8BC1                    mov eax, ecx                       // return=counter

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses: 
|:00401332(C), :0040134A(U)
|
:0040134E 5F                      pop edi                            // end
:0040134F 5E                      pop esi                            // of
:00401350 C9                      leave                              // the
:00401351 C20400                  ret 0004                           // funtion

well, now we can tell what the algo is doing, we can go and fish our serial with the lstrcmp(A)
or, we can patch, so the serial will always good (change the eax=0)
or, we can do eygen injection...

in the keygen injection we have 2 options, the cool one, and the nice one...

the nice is changing the offset of the badboy message to 00403284 and you will see the serial,
i dont think you need explaination how to do it, if you do, goto my 1st k.i tutorial..

the cool way is not hard either,
all we do is,

pushing the goodserial offset, and some more parameters, call to SetDlgItemTextA and we done !

lets see whats SetDlgItemTextA parameters are...
*******************************************************************************************
  
 The  SetDlgItemText  function sets the title or text of a control in a dialog box.  
  
 BOOL SetDlgItemText( 
  
     HWND    hwndDlg ,    	 // handle of dialog box    
     int    idControl ,    	 // identifier of control    
     LPCTSTR    lpsz      	 // text to set    
    );    	    
 
  
 Parameters :
  
 hwndDlg :  
 Identifies the dialog box that contains the control.  
  
 idControl :  
 Identifies the control with a title or text that is to be set.  
  
 lpsz :  
 Points to the null-terminated string that contains the text to be copied to the control.  

******************************************************************************************* 

so, we need hWnd ( [ebp+8] ), the control ID ( 3E9 ) and the serial address 00403284 ok,
lets check,
we need to jmp from the 1st push of the badboy message to our new location, 
push 00403284 
push 3E9
push [ebp+8]
call SetdlgItemTextA
go back after the MessageBoxA should execute... (00401270)

now, i've tried it by re-writing the code, and there is not enough space to do it..
so i'll save ya the trouble and we will start from the jmp over,
now, Snippet Creator is very very cool util, its adding code into the program,
its adding redirecting, and you can go back,
BUT!
you can do in asm, jmp 00401268, so we can do

push 00401267
ret
becuase ret is going back to the offset address on stack (esp is the pointer)
so if you will push address into stack and ret, it will do like jmp address,
you can also do
mov eax,00401268
jmp eax

that act in the same way...

so, lets get back to the SC (Snippet Creator)

1st, we set the project options,
lets do it,

select Redirect Control From Code and insert 00401255, that the offset of the 1st push
of bad boy...
now, we need to patch, select patch as New Section, it will add a new section with the code
and dont return control to the program 
(we will do it manually, but you can select return and insert 00401270, it will do the same)
and we dont need to restore overwritten instructions, so dont select it...

now, lets set our MASM directory, select Options, and set the MASM as assembler, set the path,
and we done...

now, the code it self,

i added it like that :

include <masm path>\include\windows.inc     // we need this one
include <masm path>\include\user32.inc      // we need this for the SetDlgItemText
includelib <masm path>\lib\user32.lib       // we need the lib as well
push 00403284h                              // push string offset
push 3e9h                                   // push ID 
push [ebp+8]                                // push hWnd
call SetDlgItemText                         // Set the Dlg Item text
push 00401268h                              // go back to the code
ret

you can do it like this also,

Invoke SetDlgItemText, [ebp+8],3E9h,00403284h
push 00401268h
ret 
(or the jmp eax)

and select Assemble, all good, do patch target file, write the name of section you want,
patch, close all (saving will be usfull)

and now, run the program file, you did it !!!!
yeah !!!

now, the Ending :
~~~~~~~~~~~~~~~~~

this tutorial is just example, you can do much much better stuff, like making it pushing the button
for you with sendmessage, and more and more...

so, as closer, i'd like to say, 
here is the Greet list :
------------------------

Invoker, thanks for making me write tutorials again :))
tKC, thanks for being such a good friend, tut publisher (go back to work >:]) and a delphi masta
FaNt0m, thanks for all those great crackmes that giving me a minute of joy !
and the none very-special greet list (but, they aer improtant as well !!)
Anvile,DarkMoon, PhANt0m, ThrawN, iNSiGHT Crew, #New2Cracking ppl, GodsJiva, PhoX,
GogaMoga, necrotoad, DR ppl (r0x ;p), Crudd, SantMat, Iczelion, Kwazy Webbit, krobar,
ThE-SAiNt, cokine, Unpacking Gods, d4d0 (if you see it, mail me..), ChibiHime (you to chibi),
All the dude that wrote coding/unpacking/cracking/etc.. etc.. tutorials and essays,
and many many more (is it possible ;p)

if you wanna contact me,

E-Mail : Lewsers@Hotmail.com
IRC    : EFnet / #New2Cracking
Here ! ;p
the site is down, but we are working on a new site, 
so soon, a new site will be on !!

ParaBytes, Lewsa4eva !!!