cOOleQu's CrackMe
Defeating Tricks and Traps
Written by Sphinx
Introduction |
Tools required |
Target's URL |
http://royalaccezz.cjb.net
Essay |
Ok, snoop! And geez, from the look of things, it's packed with UPX
1.20, that is, if you happen to know UPX 1.20's signature, else you could be
fooled of something else coz these signatures have all been removed (eg.
section names and
the string "UPX"). And in this case, I'll
unpack it coz it uses some stubborn anti-softice tricks so I had to
make patches :-)
And UPX won't recognize the file anymore since it's
modified (violating the UPX license agreement eh?). I used ProcDump
to
unpack it. And since UPX is already included in the script, this makes
life a bit easier :-) Anyway, my resulting [u.exe]
(yep, my unpacked
file) is about 131.072 bytes.
First off, we should kill the ADTs, here it's only similar to MeltICE. So
search for SICE. Afterwards, you'll notice that it also checks
for something else, like the SoftICE Video Driver, etc. And
here they are:
\\.\NTICE
\\.\SIWDEBUG
\\.\SIWVID
\\.\SICE
So just "rename" them to something else, like SICY or whatever.
Then sometimes, when you hit SoftICE's trigger key,
you'll see the string
I Love You printed on the console. A very interesting API used indeed :-)
Anyway, I don't like that
either so I NULLed it too. So everything's
fine now. Oh yeah, you'll also see the probable message when you enter a
name
less than 2 chars.
Ok. Let's try breakpointing GetDlgItemTextA before clicking "Check".
But first, let's fill in the registration details. I
entered Sphinx
as name and 12345 as serial. But before doing that, notice that if
you've entered something with numbers
in the serial field, if it's wrong,
it immediately quits (sux!). If they are all letters, it'll display the
"error" message. So as not
to exit immediately, I changed mine
to abcde.
Now even if we've not mashed F12 yet, we'll break! But try tracing the code
and it proves to be useless. It only sleeps ;-)
So I wondered. Hmmm, let's
try searching for any occurences of other GetDlgItemTextA or even SendMessageA.
Here,
it's only the former which is useful. The latter is just for initializing
the program icon :-) And what I found was at the start of
the main program,
so let's start there too. If you can't be bothered tracing useless code (like me)
breakpoint CreateFileA instead for a faster pace!
Anyway, after some tracing, we know that CreateFileA is being indirectly
called through the EDI register and MessageBoxA through ESI. So we'll skip
pass this coz we've already kicked the ADTs. Next I hit these:
...(some crap)... 0137:004012B9 MOV EAX,[ESP+1C] ; eax = current handle (by wm_command) 0137:004012BD MOV EBP,[ESP+14] ; ebp = dialog handle 0137:004012C1 MOV EBX,[USER32!GetDlgItemTextA] ; ebx = GetDlgItemTextA 0137:004012C7 CMP AX,03E8 ; is eax = name field handle? 0137:004012CB JNZ 0040138E ; nope? jump to useless code, else... So we know that we should be focusing on the name field. 0137:004012D1 MOV ECX,EAX 0137:004012D3 SHR ECX,10 0137:004012D6 CMP ECX,00000300 0137:004012DC JNZ 0040138EOk. What I found out about the above is this. As we're focusing on the name field, we could make ecx = 300 as we type
0137:004012E2 PUSH 000026DE 0137:004012E7 PUSH 0040C6F4 ; name buffer 0137:004012EC PUSH 000003E8 0137:004012F1 PUSH EBP 0137:004012F2 CALL EBX ; read name; eax=length 0137:004012F4 MOV ECX,EAX ; ecx = length now 0137:004012F6 CMP ECX,02 ; is it < 2? 0137:004012F9 MOV [00413BCC],ECX ; save it first 0137:004012FF JL 0040166A ; yes? jump and display "name error" messageAnyway, I'm not interesed with these anymore, so I'll leave this part for you to discover. To keygen, you could just make
0137:00401305 CDQ 0137:00401306 SUB EAX,EDX 0137:00401308 LEA EDX,[ECX*2+ECX] 0137:0040130B SAR EAX,1 0137:0040130D SUB EDX,EAX 0137:0040130F MOV EDI,0040C6F4 0137:00401314 DEC EDX 0137:00401315 OR ECX,-01 0137:00401318 XOR EAX,EAX 0137:0040131A MOV [00413BD0],EDX 0137:00401320 LEA ESI,[EDX+00058980] 0137:00401326 PUSH 00 0137:00401328 REPNZ SCASB 0137:0040132A MOV EAX,ESI 0137:0040132C MOV [00413BD4],ESI 0137:00401332 IMUL EAX,ESI 0137:00401335 LEA ESI,[EDX*4+EDX] 0137:00401338 CDQ 0137:00401339 IDIV ESI 0137:0040133B NOT ECX 0137:0040133D DEC ECX 0137:0040133E SHR ECX,1 0137:00401340 MOVSX ECX,BYTE PTR [ECX+0040C6F4] 0137:00401347 CDQ 0137:00401348 SUB EAX,EDX 0137:0040134A SAR EAX,1 0137:0040134C LEA EDX,[EAX*4+EAX] 0137:0040134F LEA EAX,[EDX*8+EAX] 0137:00401352 LEA ESI,[EAX*2+EAX] 0137:00401355 MOV EAX,88888889 0137:0040135A IMUL ESI 0137:0040135C ADD EDX,ESI 0137:0040135E SAR EDX,05 0137:00401361 MOV EAX,EDX 0137:00401363 SHR EAX,1F 0137:00401366 ADD EDX,EAX 0137:00401368 IMUL ECX,EDXAnyway, after all these, ecx = real serial (but don't forget to convert it to dec first before entering it :-)
Final Notes |