"WebExpress v2.02"

This tutorial is coming from...

 

 

##########                     #######  ####                ####   #####    ########## 
  ###    ###                       ###     #   ###                    ###   #          #         ### 
  ###    ###        ###         ###  #      ###     ###          ###  #           #        ### 
  ###    ###      ## ##        ###  #      ###    ## ##         ####                     ### 
  ###   ###      ### ###     ######    ###   ### ###         ###                   ### 
  #######       #######    ###  #      ###   #######        ###                  ### 
  ### ###        ###           ###  #      ###   ###               ####                ### 
  ###  ###       ###           ###          ###   ###             #  ###               ###       # 
  ###   ###      ###           ###          ###   ###            #   ###              ###        # 
 ###    ##       ###  #      ###          ###    ###  #      #     ###            ###        ## 
####### ####   ####   #######    #####   ####   #####  ######    ########## 

 

ReFleXZ '99

Url: Http://ReFleXZ99.cjb.net
Email: ReFleXZ@fcmail.com

 

About the essay...

Written by:

MiZ

Date: 10th January 1999
Program name: WebExpress v2.02
Program type: Win32
Program location: Here
Program filename: N/A
Program size: N/A

Tools required:
Softice 3.2 - Debugger
W32Dasm V8.9 - Disassembler

Difficult level:
Easy ( X )  Medium (   )  Hard (    )  Pro (    )

 

 

 

Introduction...

Getting WebExpress to thinks it's registered.

 

 

About the protection...

Type of protection:
Name/Serial,Nag,Timelimit

At startup you'll get a NAG.But you have an option to register.

 

 

The Essay...

Let's see what kind of protection it has.So,fire up the program,and we see evaluation notice:
a nag screen.Click on the Help menu and we will see it has registration option.So click on it
and enter any name and any code you like,click on OK button and message appears sayin that
we entered incorrect name/key.Press Ctrl+D to bring softice and type bpx MessageBeep to set
breakpoint on MessageBeep.Press Ctrl+D again to leave ice and then press OK.Ice pops up,now
press F12 to finish the function,you should be here:
 
 

|:0042047F(C)
|
:00420494 8D45D0                  lea eax, dword ptr [ebp-30]
:00420497 50                           push eax
:00420498 6A01                       push 00000001
:0042049A E8E1F0FFFF          call 0041F580
:0042049F 83C408                   add esp, 00000008
:004204A2 8B4514                   mov eax, dword ptr [ebp+14]
:004204A5 25F0000000            and eax, 000000F0
:004204AA 50                          push eax

* Reference To: USER32.MessageBeep, Ord:0187h
                                  |
:004204AB FF15845B5400            Call dword ptr [00545B84]        <---We landed here
:004204B1 68C5004200                 push 004200C5
:004204B6 8B4508                        mov eax, dword ptr [ebp+08]
:004204B9 50                               push eax
:004204BA 6830750000                push 00007530
:004204BF 6A00                           push 00000000
:004204C1 E83DD9FFFF              call 0041DE03                            <---Displays the bad reg message
:004204C6 83C410                        add esp, 00000010
:004204C9 8945F4                        mov dword ptr [ebp-0C], eax
:004204CC 837D1800                   cmp dword ptr [ebp+18], 00000000
:004204D0 0F840C000000            je 004204E2
:004204D6 8B45F8                       mov eax, dword ptr [ebp-08]

...

:00420552 5F                      pop edi
:00420553 5E                      pop esi
:00420554 5B                      pop ebx
:00420555 C9                      leave
:00420556 C3                      ret

Now press F10 until you are on the above "ret" instruction,then press F10 once more.
You will be here:

* Possible Reference to String Resource ID=00925: "Incorrect name and/or key.
Enter your registration name and "
                                  |
:00459171 689D030000              push 0000039D
:00459176 A1D8C15300              mov eax, dword ptr [0053C1D8]
:0045917B 50                             push eax
:0045917C E8B6C90100              call 00475B37
:00459181 83C410                       add esp, 00000010
:00459184 6A00                          push 00000000
:00459186 6A10                           push 00000010
:00459188 8D8570FEFFFF            lea eax, dword ptr [ebp+FFFFFE70]
:0045918E 50                                push eax
:0045918F 8D85C0FEFFFF            lea eax, dword ptr [ebp+FFFFFEC0]
:00459195 50                                push eax
:00459196 8B4510                        mov eax, dword ptr [ebp+10]
:00459199 50                               push eax
:0045919A E87D72FCFF              call 0042041C                              <--- We land here
:0045919F 83C414                       add esp, 00000014
:004591A2 33C0                          xor eax, eax
:004591A4 E95E000000              jmp 00459207

Now we scroll up a bit and we see:

:00459126 6A03                            push 00000003
:00459128 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:0045912E 8B4030                         mov eax, dword ptr [eax+30]
:00459131 50                                push eax
:00459132 8B856CFEFFFF            mov eax, dword ptr [ebp+FFFFFE6C]
:00459138 8B4016                         mov eax, dword ptr [eax+16]
:0045913B 50                                push eax
:0045913C E860EAFFFF               call 00457BA1                       <--- Check if registered
:00459141 85C0                            test eax, eax                             <--- EAX=1 ?
:00459143 0F8560000000              jne 004591A9                        <--- If not then jump
:00459149 6A50                            push 00000050         good guy
:0045914B 8D8570FEFFFF            lea eax, dword ptr [ebp+FFFFFE70]
:00459151 50                                push eax

* Possible Reference to String Resource ID=00924: "Error"
                                  |
:00459152 689C030000               push 0000039C
:00459157 A1D8C15300              mov eax, dword ptr [0053C1D8]
:0045915C 50                              push eax
:0045915D E8D5C90100              call 00475B37
:00459162 83C410                       add esp, 00000010

* Possible Ref to Menu: MenuID_07D0, Item: "Promote List"
                                  |
:00459165 6800010000                   push 00000100
:0045916A 8D85C0FEFFFF             lea eax, dword ptr [ebp+FFFFFEC0]
:00459170 50                                  push eax

Now,look at the code above.We see that at :00459143 there is a jump which jumps over bad serial
message.But before that there's a call function.Let's see what's in it.So go up a bit and press
F9 in softice at line :0045913C,disable your other breakpoint by typing BD 00.Press Ctrl+D to get
out of softice.Then press ok again and softice should pop up.Then type T in ice to trace the
function.You'll land here:

* Referenced by a CALL at Addresses:
|:0045817C   , :0045913C
|
:00457BA1 55                         push ebp                                      <--- We land here
:00457BA2 8BEC                    mov ebp, esp
:00457BA4 83EC14                 sub esp, 00000014
:00457BA7 53                         push ebx
:00457BA8 56                         push esi
:00457BA9 57                         push edi
:00457BAA 8B4510                 mov eax, dword ptr [ebp+10]
:00457BAD 50                         push eax
:00457BAE 8B4508                  mov eax, dword ptr [ebp+08]
:00457BB1 50                          push eax
:00457BB2 E835FFFFFF          call 00457AEC                              <---Generates serial
:00457BB7 8945F0                   mov dword ptr [ebp-10], eax
:00457BBA C745FC01000000          mov [ebp-04], 00000001
:00457BC1 C745EC00000000          mov [ebp-14], 00000000
:00457BC8 8B450C                  mov eax, dword ptr [ebp+0C]
:00457BCB 8945F4                  mov dword ptr [ebp-0C], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457C11(U)
|
:00457BCE 8B45F4                  mov eax, dword ptr [ebp-0C]
:00457BD1 8A00                      mov al, byte ptr [eax]
:00457BD3 8845F8                   mov byte ptr [ebp-08], al
:00457BD6 FF45F4                   inc [ebp-0C]
:00457BD9 33C0                      xor eax, eax
:00457BDB 8A45F8                  mov al, byte ptr [ebp-08]
:00457BDE 85C0                      test eax, eax                              <---If eax=0 then
:00457BE0 0F8430000000         je 00457C16                          <---Jump
:00457BE6 33C0                       xor eax, eax
:00457BE8 8A45F8                   mov al, byte ptr [ebp-08]
:00457BEB 50                          push eax

* Reference To: USER32.CharUpperA, Ord:0028h
                                  |
:00457BEC FF15D45A5400            Call dword ptr [00545AD4]
:00457BF2 25FF000000                  and eax, 000000FF
:00457BF7 83E841                         sub eax, 00000041
:00457BFA 0FAF45FC                    imul eax, dword ptr [ebp-04]
:00457BFE 0145EC                         add dword ptr [ebp-14], eax
:00457C01 8B45FC                         mov eax, dword ptr [ebp-04]
:00457C04 8BC8                             mov ecx, eax
:00457C06 8D0480                          lea eax, dword ptr [eax+4*eax]
:00457C09 8D0480                          lea eax, dword ptr [eax+4*eax]
:00457C0C 03C1                             add eax, ecx
:00457C0E 8945FC                         mov dword ptr [ebp-04], eax
:00457C11 E9B8FFFFFF                 jmp 00457BCE

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457BE0(C)
|
:00457C16 8B45F0                      mov eax, dword ptr [ebp-10]
:00457C19 3945EC                      cmp dword ptr [ebp-14], eax  <---If not equal then
:00457C1C 0F850A000000           jne 00457C2C                     <---beggar off cracker
:00457C22 B801000000                mov eax, 00000001             <---registered
:00457C27 E902000000                jmp 00457C2E

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457C1C(C)
|
:00457C2C 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457C27(U)
|
:00457C2E E900000000              jmp 00457C33

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00457C2E(U)
|
:00457C33 5F                          pop edi
:00457C34 5E                          pop esi
:00457C35 5B                          pop ebx
:00457C36 C9                          leave
:00457C37 C20C00                  ret 000C

Well all we need to do is to change je 00457C16 at :00457BE0 to jne 00457C16 and jne 00457C2C
at :00457C1C to je 00457C2C.

How to do it?

Open webex.exe to your favourite Hexeditor and search for bytes:

8A45F885C00F84 replace with 8A45F885C00F85

and

3945EC0F850A000000 replace with 3945EC0F840A000000

 

 

Final notes...

Greetz and thanx:

McCodEMaN,Bjanes,The Sandman,CrackZ,+ORC,Jeff,Eternal Bliss.....and all otherz....

 

Disclaimer...

This tutorial is written for EDUCATIONAL purposes only.
So if you want to use the program after its trial period ends please BUY IT!
Support shareware(and its authors), this is our learning tool!

 
ReFleXZ is not responsibile for any damage caused with this essay or any of its parts.
So everything what you're doing and 'experimenting' is on your own responsibile!

 
Also, in this tutorial you'll not find any serial numbers, so try to search
elsewhere under Cracks and Warez.

Copyright © 1999 by ReFleXZ '99
All rights reserved