|
Let's see what kind of protection it
has.So,fire up the program,and we see evaluation notice:
a nag screen.Click on the Help menu and
we will see it has registration option.So click on it
and enter any name and any code you
like,click on OK button and message appears sayin that
we entered incorrect name/key.Press
Ctrl+D to bring softice and type bpx MessageBeep to set
breakpoint on MessageBeep.Press Ctrl+D
again to leave ice and then press OK.Ice pops up,now
press F12 to finish the function,you
should be here:
|:0042047F(C)
|
:00420494
8D45D0
lea eax, dword ptr [ebp-30]
:00420497
50
push eax
:00420498
6A01
push 00000001
:0042049A
E8E1F0FFFF call 0041F580
:0042049F
83C408
add esp, 00000008
:004204A2
8B4514
mov eax, dword ptr [ebp+14]
:004204A5
25F0000000
and eax, 000000F0
:004204AA
50
push eax
* Reference To:
USER32.MessageBeep, Ord:0187h
|
:004204AB
FF15845B5400
Call dword ptr [00545B84] <---We
landed here
:004204B1
68C5004200
push 004200C5
:004204B6
8B4508
mov eax, dword ptr [ebp+08]
:004204B9
50
push eax
:004204BA
6830750000
push 00007530
:004204BF
6A00
push 00000000
:004204C1
E83DD9FFFF
call 0041DE03 <---Displays
the bad reg message
:004204C6
83C410
add esp, 00000010
:004204C9
8945F4
mov dword ptr [ebp-0C], eax
:004204CC
837D1800
cmp dword ptr [ebp+18], 00000000
:004204D0
0F840C000000
je 004204E2
:004204D6
8B45F8
mov eax, dword ptr [ebp-08]
...
:00420552
5F
pop edi
:00420553
5E
pop esi
:00420554
5B
pop ebx
:00420555
C9
leave
:00420556
C3
ret
Now press F10 until you are on the above
"ret" instruction,then press F10 once more.
You will be here:
* Possible Reference to
String Resource ID=00925: "Incorrect name and/or key.
Enter your registration
name and "
|
:00459171
689D030000
push 0000039D
:00459176
A1D8C15300
mov eax, dword ptr [0053C1D8]
:0045917B
50
push eax
:0045917C
E8B6C90100
call 00475B37
:00459181
83C410
add esp, 00000010
:00459184
6A00
push 00000000
:00459186
6A10
push 00000010
:00459188
8D8570FEFFFF
lea eax, dword ptr [ebp+FFFFFE70]
:0045918E
50
push eax
:0045918F
8D85C0FEFFFF
lea eax, dword ptr [ebp+FFFFFEC0]
:00459195
50
push eax
:00459196
8B4510
mov eax, dword ptr [ebp+10]
:00459199
50
push eax
:0045919A
E87D72FCFF
call 0042041C <---
We land here
:0045919F
83C414
add esp, 00000014
:004591A2
33C0
xor eax, eax
:004591A4
E95E000000
jmp 00459207
Now we scroll up a bit and we see:
:00459126
6A03
push 00000003
:00459128
8B856CFEFFFF
mov eax, dword ptr [ebp+FFFFFE6C]
:0045912E
8B4030
mov eax, dword ptr [eax+30]
:00459131
50
push eax
:00459132
8B856CFEFFFF
mov eax, dword ptr [ebp+FFFFFE6C]
:00459138
8B4016
mov eax, dword ptr [eax+16]
:0045913B
50
push eax
:0045913C
E860EAFFFF
call 00457BA1 <---
Check if registered
:00459141
85C0
test eax, eax <---
EAX=1 ?
:00459143
0F8560000000
jne 004591A9 <---
If not then jump
:00459149
6A50
push 00000050 good guy
:0045914B
8D8570FEFFFF
lea eax, dword ptr [ebp+FFFFFE70]
:00459151
50
push eax
* Possible Reference to
String Resource ID=00924: "Error"
|
:00459152
689C030000
push 0000039C
:00459157
A1D8C15300
mov eax, dword ptr [0053C1D8]
:0045915C
50
push eax
:0045915D
E8D5C90100
call 00475B37
:00459162
83C410
add esp, 00000010
* Possible Ref to Menu:
MenuID_07D0, Item: "Promote List"
|
:00459165
6800010000
push 00000100
:0045916A
8D85C0FEFFFF
lea eax, dword ptr [ebp+FFFFFEC0]
:00459170
50
push eax
Now,look at the code above.We see that
at :00459143 there is a jump which jumps over bad serial
message.But before that there's a call
function.Let's see what's in it.So go up a bit and press
F9 in softice at line :0045913C,disable
your other breakpoint by typing BD 00.Press Ctrl+D to get
out of softice.Then press ok again and
softice should pop up.Then type T in ice to trace the
function.You'll land here:
* Referenced by a CALL at Addresses:
|:0045817C , :0045913C
|
:00457BA1
55
push ebp <---
We land here
:00457BA2
8BEC
mov ebp, esp
:00457BA4
83EC14
sub esp, 00000014
:00457BA7
53
push ebx
:00457BA8
56
push esi
:00457BA9
57
push edi
:00457BAA
8B4510
mov eax, dword ptr [ebp+10]
:00457BAD
50
push eax
:00457BAE
8B4508
mov eax, dword ptr [ebp+08]
:00457BB1
50
push eax
:00457BB2
E835FFFFFF call 00457AEC <---Generates
serial
:00457BB7
8945F0
mov dword ptr [ebp-10], eax
:00457BBA
C745FC01000000
mov [ebp-04], 00000001
:00457BC1
C745EC00000000
mov [ebp-14], 00000000
:00457BC8
8B450C
mov eax, dword ptr [ebp+0C]
:00457BCB
8945F4
mov dword ptr [ebp-0C], eax
* Referenced by a
(U)nconditional or (C)onditional Jump at Address:
|:00457C11(U)
|
:00457BCE
8B45F4
mov eax, dword ptr [ebp-0C]
:00457BD1
8A00
mov al, byte ptr [eax]
:00457BD3
8845F8
mov byte ptr [ebp-08], al
:00457BD6
FF45F4
inc [ebp-0C]
:00457BD9
33C0
xor eax, eax
:00457BDB
8A45F8
mov al, byte ptr [ebp-08]
:00457BDE
85C0
test eax, eax <---If
eax=0 then
:00457BE0
0F8430000000 je 00457C16 <---Jump
:00457BE6
33C0
xor eax, eax
:00457BE8
8A45F8
mov al, byte ptr [ebp-08]
:00457BEB
50
push eax
* Reference To:
USER32.CharUpperA, Ord:0028h
|
:00457BEC
FF15D45A5400
Call dword ptr [00545AD4]
:00457BF2
25FF000000
and eax, 000000FF
:00457BF7
83E841
sub eax, 00000041
:00457BFA
0FAF45FC
imul eax, dword ptr [ebp-04]
:00457BFE
0145EC
add dword ptr [ebp-14], eax
:00457C01
8B45FC
mov eax, dword ptr [ebp-04]
:00457C04
8BC8
mov ecx, eax
:00457C06
8D0480
lea eax, dword ptr [eax+4*eax]
:00457C09
8D0480
lea eax, dword ptr [eax+4*eax]
:00457C0C
03C1
add eax, ecx
:00457C0E
8945FC
mov dword ptr [ebp-04], eax
:00457C11
E9B8FFFFFF
jmp 00457BCE
* Referenced by a
(U)nconditional or (C)onditional Jump at Address:
|:00457BE0(C)
|
:00457C16
8B45F0
mov eax, dword ptr [ebp-10]
:00457C19
3945EC
cmp dword ptr [ebp-14], eax <---If
not equal then
:00457C1C
0F850A000000
jne 00457C2C <---beggar
off cracker
:00457C22
B801000000
mov eax, 00000001 <---registered
:00457C27
E902000000
jmp 00457C2E
* Referenced by a
(U)nconditional or (C)onditional Jump at Address:
|:00457C1C(C)
|
:00457C2C
33C0
xor eax, eax
* Referenced by a
(U)nconditional or (C)onditional Jump at Address:
|:00457C27(U)
|
:00457C2E
E900000000
jmp 00457C33
* Referenced by a
(U)nconditional or (C)onditional Jump at Address:
|:00457C2E(U)
|
:00457C33
5F
pop edi
:00457C34
5E
pop esi
:00457C35
5B
pop ebx
:00457C36
C9
leave
:00457C37
C20C00
ret 000C
Well all we need to do is to change je
00457C16 at :00457BE0 to jne 00457C16 and jne 00457C2C
at :00457C1C to je 00457C2C.
How to do it?
Open webex.exe to your favourite
Hexeditor and search for bytes:
8A45F885C00F84 replace with 8A45F885C00F85
and
3945EC0F850A000000 replace with 3945EC0F840A000000
|