New 2 Cracking
~~~~~~~~~~~~~~

Tutorial Type  : Lecture
Tutorial Topic : HOW TO UNDERSTAND THE WHY (PART 2)
Wriiten by     : ParaBytes
Date           : Jan. 8th, 2002.
Music          : Some nice quiet music, or Final Countdown ;)
Remarks        : This one will be the 2nd lecture in the course of "HOW TO UNDERSTAND THE WHY"


Start (?)
~~~~~~~~~

Ok, its 22:00, i read the last lecture, and i said, well this one explained what to
look for, now, when you do know it, lets try to learn how to get why even we have
bad tutorials to read...
i rememberd when i sat with someone i know in real life, and told him, 
"why do you patch jne>je if you want it to jump ?? do jne>jmps"
(jump sectional, always jumps byte range 128 bytes up/down the code)
and he said, "no man, i do what i know, not what you say i should do..."

that thing made me realize how bad condition people are...
if you dont want to nop the code, do eb00, that will ALWAYS jump to the next code line...
that one example, but people wont do it, becuase they are afraid from what they dont know...

Middle (?)
~~~~~~~~~~

Ok, this supposed to be the main part...
lets take an example for a bad tutorial,
"bpx GetDlgItemTextA,
 press F11 one time,
 we landed on 00407654,
 click about 10 times on F10,
 now, do you see the call into 00401000 ?
 trace into it..
 click F10 13 times,
 do d eax
 do you see your serial ?
 now, do d edx, 
 hey, that our serial !
 yay !"

the tutorial will probablly have some code snippets, 
to show you what code you should be seeing, 
so dont take the part i wrote, its a shorting of a bad tutorial... ;)

now, if you are a newbie,
and you know just how to use softice, not more,
this code will help you to get the serial,
but not to understand the cracking...

lets try to learn why we breaked this place, 
we did it because the program is need to get the text from the dialog edit box...
ok, 
why did ^P RET (F11) ? 
because we broke into the kernel code, and we dont need to trace there
we can se the normal code ;p
and why have we landed <offset>, 
that because we have the algo located there, the programmers did it,
but you can find the same location using your w32dasm, or other disassemblers 
(unless the file is packed/crypted or something smiliar ;p).

well, about the trcae here/there, 
that hard to understand what we need to do with this, 
but i suggest, do what i do in my math homework, 
you have the final answer (where the needed call ;p and stuff)
so try to understand what the code between the part you broke on to the call/serial compare is doing, 
try to do d <register/memory location> every couple of steps, 
try to understand what the programmer were thinking when he coded that algo, 
like, hmmm, he did this, so the serial will
be like that, 
if its a code that making all the letters upacased (LIKE THAT ;p)
try to understand how its going to change the serial if it wont do it, 
after you unerstand that part, 
you can make a keygen easier, 
or patch if you need, you will know where
and what to do...

the rest is kinda ok, becuase its just d <something>

and remember, 
its not a shame to do d <param> every step, 
many people do that, but that because lack of thinking, 
and lack of good tutorials ( REALLY ! :(( )
so its ok...

i do tracing in win32dasm, its not hard, 
just learn some basic asm, 
and make sure to know how the program works, 
and also make sure always, 
that you have win32.hlp/msdn in yuor hard disk,
if you do this, you can understand the code, 
without softice, you can use logic to see,
like, if you see

push 10
push <addressX>
push <addressY>
Call GetDlgItemTextA
mov esi,<addressX>
lodsd
cmp eax,50617261
jnz badboy

you will know that :
in addressX we have the fake serial stored, 
and the serial, 
after lodsd (that load string dword into eax)
we need that eax='Para' 
(Para, in hex letters, is 50=P, 61=a, 72=r, 61=a - fix me if i wrong)
and that means, that we already knows part of the serial...
after couple of times you'll get it...
its not hard...

End (?)
~~~~~~~

Ok, i hope you understood what i mean to teach here...
if you dont, mail me...
all you need is logic+win32hlp+some asm knowledge tat will make you a great crackers...
and then, you will see that PnP cracking (Pen n Paper debugging) is not so hard...
its even kinda easy...

and if you need win32.hlp, its supplied with borland compilers, if you dont have it, you
can also get it from Kwazy Webbit's site http://its.mine.nu

enjoy....
ParaBytes.

 Greets :
__________
|_|_==_|_|

big one, NeO'X'QuiCk, who helpped me making this tutorial better....

the guys who came to my channel to tell me how lame i am, thanks alot 
(\bleh\, i know its a clone of someone, i dont care who, but tnx, really..)
you made me understand, how much the scene is sick, when people, instead of teaching and tut'ing
go and flame each other, sheesh !

to ThE-SAiNt, GodsJiva, tKC, krobar, other ppl who publish my tutorials, all the people i greeted 
last tutorial ;))
and, comrade, NeO'X'QuiCk, sinny, Dawai, Ates, death, PunkGuy2, d4d0, ChibiHime, hutch, Iczelion,
roy, Ates (my guru), ASTAGA, all the tuters, all the guys who check registers with d eax every step ;)
all newbies, ufk, yates, Santmat, Kwazy Webbit, kaparo, Bob (you know him, bob marley ;p), 
Marlboro Ciggies, Anvile, GogaMoga, death, AirW0lf, Snacker, snaker, GlO, ThrawN, some evc, some lucid,
most TERRORiSTS X, some embrace, 
some here and some there...
many many more...
YOU !
(i can continue this endless.. so i'll stop here)

Contact me :
~~~~~~~~~~~~

E-Mail : Lewsers@Hotmail.Com
IRC    : EFNet / #New2Cracking
Here ;p

ParaBytes, Logic0wnz