SalesAgent
Macromedia: Dreamweaver 2 & FreeHand 8
Written by McCodEMaN
Introduction |
Greetings and welcome to the noble art of reverse engineering!
Tools required |
Numega SoftIce v3.xx
W32Dasm v8.9x
Target's URL |
http://www.macromedia.com
Essay |
Part one: Unlocking SalesAgent. Dreamweaver 2!
Step1 Run dreamW2.exe
Step2 Choose [Buy Now] and you will get the reg.window, after
that exit dreamW2.exe
and go
to: C:\WINDOWS\ rsagent.ini
if you
trace through the file you will find: 'mailstat = 0' change
it to '1'
like this:
mailstat = 1
Note:
If you already have one SalesAgent protected program installed and registred
you might have more then one mailstat string!
Step3 Run dreamW2.exe again and choose [Buy Now], now you should
be able to see the
unlocking-window!
Ok i see it,
but what did i do to make this happen?
Well, when we
changed mailstat from 0 to 1 we faked the registration transmition, which
enabled
the unlocking-window!
0 = No
online registration has been made, [Buy Now] = display registration form.
1 = Online
registration has been made and is ok, [Buy Now] = display unlocking-window!
Step4 Ok, type in: First and Last name and '1234567890' as your
fake unlockingcode!
Hm, why
do i`v to use that stupid serial you ask..well, you don`t!
But you
must use more then ten chars, i`ll tell you why later on!
Step6 Now, fire up softIce and place a bp on 'BPX GetDlgItemTextA'
then return to dreamW2
and press [OK]
and SoftIce breaks due to BPX USER32! GetDlgItemTextA.
Step7 Press 'F11' once!
Step8 You should land here.............
:10005B42 MOV
EDI , 100032320 <= Here!
Step9 Now go to.................
:10005B51 CMP
ECX , 0A <= Check numbers of chars in unlockingcode!
:10005B54
JZ 10005B95 <= Good Jump! If less then
10 chars don`t jump!
Step10 Go to........................
:10005BDA PUSH
EAX => Personal code!( You can find it at the unlockingW.)
:10005BDB CALL
1000BF20 <= The Routine!
:10005BE3 LEA
ECX , [ESP + 000000D8] => The valid serial!
:10005BEA PUSH
10032320 => Our fake unlockingcode!
:10005BEF PUSH
ECX => Saves valid unlockingcode!
Step11 When you understand this protection you can disable your active
bp!
Part two: Dream weaver2 Serialization!
When we had unlocked the SalesAgent protection we thought..OK!..let`s
have some fun before we
uninstall it!
Ha Ha Ha stupid cracker, did you really think we let you in so easy...the
program said and a second
registration nag appeared!
Hmmm, have the guys at Macromedia been working overtime? Well, more
fun for us then!!
Ok, why not use W32Dasm this time!
Step1 Disassemble dreamW2.exe, this can take some time!
Step2 Open 'Refs' and 'SDR', then search through the references....WHAT
IS THIS?!!!
DWW200-XXXXX-XXXXX-XXXXX
Damn Macromedia,
a half day to disassemble the file and nothing to patch!
Well, let`s
uninstall it and start all over with an other target!!
Part three: Unlocking SalesAgent. Macromedia FreeHand 8
Step1 Run FreeHand8.exe!
Step2 Press 'B' to enter the registration form, then exit FreeHand8.exe!
Step3 Change mailstat in rsagent.ini
Step4 Run FreeHand8 again and press 'B' to get the unlocking-window.
Enter userinfo.
and 10 chars as your serial!
Fire up SoftIce
and place a bp on BPX GetDlgItemTextA. then
return to FreeHand
and press [OK] and softice breaks!
Step5 Press 'F11' once!
Step6 You should land here.............
:100074CD
CALL [USER32!GetDlgItemTextA]
:100074D3
PUSH 100528B0 <= Here!
Step7 Go to.................
:100074E0
CMP EAX , 0A <=Check numbers of chars in unlockingCode!
:100074E3
JZ 10007524 <= Good Jump!If less then
10 chars don`t jump!
Step8 At....................
:10007524
PUSH 100517D0 <= Personal code!
:10007529
LEA ECX , [EBP-00B0] <= fake code!
Step9 Trace down to.......
:1000753C
MOV EAX , [10051DC0] <= Personal code!
Step10 And at..........
:1000754D
PUSH ECX <= Our personal code again!
Step11 If you trace down to.............
:10007556
PUSH 100528B0 <= We find our fake unlockingcode!
Step12 And at last...............
:1000755E
PUSH EDX <= Saves valid serial!!
Step13 When you understand this protection you can disable your active
bp!
Final Notes |