New 2 Cracking
~~~~~~~~~~~~~~

Tutorial Type  : Essay
Tutorial Topic : Unpacking Visual C++ Programs
Written by     : ParaBytes
Date           : Mar. 22th, 2002.
Music          : Bob Marley CD's (Survival)
Utilities      : SoftICE / PEiD / W32Dasm / ProcDump / GTW / Hex Editor (HexWorkshop 3.11)
Remarks        : We will unpack vc++ 5.0 program called API SPY, i did the nt/2k version
                 should work the same on the 9x version. (http://www.biosys.net/apis32)


Start :
~~~~~~~
Lets check the program. 
ok, nag, unregistred, and a place to insert name/serial.

that nice...
lets try peid on the exe file, nothing detected ?
well, lets try gtw, petite 1.2
ohh, nice...

lets keep on checking other dll's and exe's
well, all except LibEdit are petite 1.2,
LibEdit.exe is VC++ 5.0

ok, lets review the idea,
we need to break in softice, on the start of executing the UNPACKED file...

2 ways to do it,
1st is complicated, but its ALMOST-FULLY UNVIERSAL (on GUI programs..)
bpx GetCommandLineA
and count the number of times until start, run again,
remember to do F12 once, and see what RVA you are on...
on the last time called, stop, trace back on the code until you see something
that looks like Entry Point (start of code)

push ebp         <---- OEP
push some more.. <---- Stuff
call [KERNEL32.DLL!GetCommandLineA] <--- Call :)
more stuff <---- Stuff

and then you dump, and fix.

the 2nd way, easier on vc++ is
taknig the 1st API called on vc++ programs, GetVersion
again, the same idea, count how many times executed (this time 3 i think)
close, re-run and remember to stop before the last one

(W32Dasm UNPACKED file code...)

//******************** Program Entry Point ********
:004045A0 55                      push ebp
:004045A1 8BEC                    mov ebp, esp
:004045A3 6AFF                    push FFFFFFFF
:004045A5 6800704000              push 00407000
:004045AA 68B8554000              push 004055B8
:004045AF 64A100000000            mov eax, dword ptr fs:[00000000]
:004045B5 50                      push eax
:004045B6 64892500000000          mov dword ptr fs:[00000000], esp
:004045BD 83C4A8                  add esp, FFFFFFA8
:004045C0 53                      push ebx
:004045C1 56                      push esi
:004045C2 57                      push edi
:004045C3 8965E8                  mov dword ptr [ebp-18], esp

* Reference To: KERNEL32.GetVersion, Ord:014Ch
                                  |
:004045C6 FF1530D34000            Call dword ptr [0040D330]
:004045CC 33D2                    xor edx, edx
:004045CE 8AD4                    mov dl, ah


so, as you can see, you breaked on 004045C6
all you do is back trace to the point you see 
push ebp (004045A0)

so the entry point is 45A0
do dump the process you do,
bc *
d eip
alt-d
write on a paper the 2 bytes there (33D2)
change them to EBFE (jmp eip, infite loop)
[return]
ctrl-d
ProcDump
dump the process, dumped.exe
PE Editor, open the dumped.exe
change the Entry Point to
000045A0
go back to softice
alt-d
restore the bytes (33D2)
[return]
ctrl-d
exit the program

now, that part is also very important.
whenever you'll try to start the dumped.exe
you'll fail, why ?
because the 1st thing after GetVersion is the inf. loop
so we need to hexedit that back to the normal thing..
so, open the file on HexWorkshop (or whatever)
search for byte pattern EBFE (noone will use this pattern, its the loop :P)
and change it to the original bytes...
33D2
save, exit
and we finished.
you can start W32Dasm now, dumped.exe
and its like new :)

for me its didnt worked (the dumped.exe)
but now i can patch and create a loader...
so, lets have fun cracking the program in many different ways >:>

that all...

hope you understood...

Greets :
~~~~~~~~
Qwerton, Invoker, PhANt0m, FaNt0m, tKC, BuLLeT, DAEMON, CHRISTOPH, snaker, VAG, SAC,
UG 2002, New 2 Cracking ppl, GogaMoga, Bob Marley, Phox, The Fox, SantMat, many more...
many many more.. (sorry if i havnt wrote you),
Anvile (yeah, he's "special" so he get the last greet ;p)
and the NCU institute...

Contact Me :
~~~~~~~~~~~~
E-Mail : Lewsers@Hotmail.Com
IRC    : EFNet - #New2Cracking
Here ;p

Bye folks...
cya on the next tut !

ParaBytes, 808m4r13yr0xx0r >:>
