BuLLeT's Crackme V4.75

"BuLLeT's Crackme V4.75"

This tutorial is coming from...

##########                     ####### ####                ####   #####    ##########
###    ###                       ###     #   ###                    ###   #          #         ###
###    ###        ###         ### #      ###     ###          ### #           #        ###
###    ###      ## ##        ### #      ###    ## ##         ####                     ###
###   ###      ### ###     ######    ###   ### ###         ###                   ###
#######       #######    ### #      ###   #######        ###                  ###
### ###        ###           ### #      ###   ###               ####                ###
### ###       ###           ###          ###   ###             # ###               ###      #
###   ###      ###           ###          ###   ###            #   ###              ###       #
###    ###       ### #      ###          ###    ### #      #     ###            ###       ##
####### ####   ####   #######    #####   ####   ##### ######    ##########

ReFleXZ '99 Url: Http://ReFleXZ99.cjb.net Email: ReFleXZ99@fcmail.com

About the essay...

Written by
Bjanes

Date: 4th January 1999
Program name: BuLLeT's Crackme V4.75
Program type: Win32 CrackMe
Program location: Here
Program filename: cia475.zip
Program size: 163 Kb

Tools required:
Softice 3.2 - Debugger
W32Dasm V8.9 - Disassembler

Difficult level:
Easy ( X ) Medium ( ) Hard ( ) Pro ( )

Introduction...

The author says about crackme:

"Well here it is...CrackMe v4.75 by me ;)
First i'd like to say that if you're an average cracker don't even unZIP this.
This crackme is made for newbies (hardcoded serial), so if you have other
things to do, do them first :P Anyway...to everyone who want's to give this
a try: DON'T EDIT/HIEW/READ the B-CRK475.EXE, this will be considered as
CHEATING since the serial is hardcoded in the file. If you can't resists and
do it anyway always keep in mind: "I'M A CHEATER - I'M A CHEATER....and so on"
I want you to think that every time you even just SEE the file. OK ??
Hehehe...just kidding...but plz try to do it without EDIT or similar appz."

About the protection...

Type of protection: Serial only When you run the program you'll see small window with some
text about the program and one text box to enter the serial.
To check the serial you must press "UNLOCK" button.

If you enter bad serial, error message will appear instaed
textbox, otherwise correct serial message will appear!

GOOD MESSAGE = "Unlock succesfull, read rulez above !"
BAD MESSAGE = "Wrong serial.....try again ;)"

The Essay...

Just how author says unlock code is hardcoded into file!
But after making dead list of program with W32dasm
and unsucessfuly searching for string that could be a serial,
I decide to find correct unlock key with Softice.

After some unsucessful trying to break Sice with
my *favourite* breakpoints (GetWindowTextA and
GetDlgItemTextA), I set a breakpoint to system function
Hmemcpy and Sice breaks!!

Ok, first run the program.
Enter any random unlock key.
Now fire up Sice with "CTRL-D" type "BPX HMEMCPY" and
leave softice, again "CTRL-D".
Press "UNLOCK" button to verify is our key correct.

Softice now breaks at the beginning of Hmemcpy function.
To return to the programs code press...

"F11" - once,
"F12" - six times,
"F10" - twenty-three times

Congratulation, you just landed at comparation routine code!
Now you can see this part of code:

:004408DA 8D55FC                  lea edx, dword ptr [ebp-04]
:004408DD 8B83D0020000            mov eax, dword ptr [ebx+000002D0]
:004408E3 E8BC14FEFF              call 00421DA4
:004408E8 8B45FC                  mov eax, dword ptr [ebp-04] ;Our fake unlock key
:004408EB BA3C094400              mov edx, 0044093C            ;"This program must be run under Win32"
:004408F0 E83732FCFF              call 00403B2C                ;Comparation routine???
:004408F5 750F                    jne 00440906                 ;If password is wrong display error????
:004408F7 B201                    mov dl, 01

Press "F10" until you get to 4408EB.
Now type "D EAX" to see what is EAX containing.
It's our *fake* unlock code!

Press "F10" once.
Type "D EDX" to see what is EDX containing.
Hmmm....something strange here!
EDX is containing this text "This program must be run under Win32"!
We run program under Windows, didn't we??...of course we did ;-)

Here is also one call at 4408F0 and (C)onditional jump at 4408F5!
Hmm...all that looks like comparation routine, let's check it!
Press "F10" until you step on 4408F5 JNE 440906!
If this is comparation routine then this jump takes us
to part of code that displays error message!

Now type "R FL Z" to set zero flag and program will not jump!

Press "CTRL-D" and you'll see message witch indicates
that our password is correct!
Let's now see what we have.
We have our *fake* code located in EAX, we have
"This program must be run under Win32" message located
in EDX! Program then compares EAX and EDX and jump if not same!

Message in EDX is correct password???
There is only one way to find out!
Type "This program must be run under Win32" into programs
text box and press "UNLOCK" button!
Message "Unlock succesfull, read rulez above!" appeared.
We were right, that was correct serial!

Final notes...

Author of this crackme wants to fool us into the thing that
program has hardcoded unlock key!
It actually has, but searching for some string that can be
correct key in W32dasm we'll never say that string
"This program must be run under Win32" is correct serial!
However we still need Softice help to crack this babe!

My thanks and gratitude goes to:-

The Sandman for his great site(the best site for newbies) full of knowledge and for
his cracking forum(also the best on the net)!

Eternal Bliss, my best 'virtual' friend, for all what he done for me!

MiZ, also the great friend of mine. For all the time that I spent with you :)

Disclaimer...

This tutorial is written for EDUCATIONAL purposes only. So if you want to use the program after its trial period ends please BUY IT! Support shareware(and its authors), this is our learning tool! ReFleXZ is not responsibile for any damage caused with this essay or any of its parts. So everything what you're doing and 'experimenting' is on your own responsibile! Also, in this tutorial you'll not find any serial numbers, so try to search elsewhere under Cracks and Warez.