UniView v1.23
Unpacking UPX

Written by anTiHerO

Introduction

Protection: Registration and 30 Day Time-Limit, Packed executable.

About: UniView is a powerful and easiest-to-use image viewer and converter for Windows 9x/Windows NT/Windows ME and Windows 2K! In addition, it provides many extra functions to operate the image files easily and quickly.

Main features:

· Support for most popular image formats, including *.AFI,*.BMP, *.VST, *.TGA, *.PNG, *.PCC, *.PCX, *.DCX, *.TIFF(Including Multipaged TIFF), *.JPEG, *.GIF(Including animated GIF), *.WMF, *.EMF, *.ICO,*.PBM,*.PGM, *.PPM, *.MAC, *.IMG, *.PCD, *.UFO(And convert GIF to AVI format).

· Scroll, manual and auto zoom, rotate and full-screen mode features allow you to view your images the way you want.

· Slide show gives you the ability to view a sequence of images automatically. UniView provides forward/reverse/random sequencing features.

· Support to set the image for the desktop wallpaper as centered, tiled and stretched.

· Support Drag & Drop operations on files.

· Support to convert image files from one format to another in one and in batch.

· Support to associate file with a special kinds of types.

· Support to change the display mode dynamically.

Tools required

Debugger (Softice or TRW2000)

Dissassembler (W32Dasm or IDA)

Hex Editor (eg Hex Workshop , HIEW)

ProcDump 1.6.2

Half a brain

Target's URL

http://www.qwerks.com

Essay

OK, shall we begin? Lets take a look at the protection. Start up the program, and open the Help/Registration option and you should see the registration box with two empty dialogue boxes, I just entered;

Name: anTiHerO

Serial: 1212121212

Click OK, “ Invalid Registration Code! “ box pops up. Right! Lets fish for a serial. Close the Invalid Registration Code! Box, bring up your debugger window, and set a breakpoint on the hmemcpy function by typing;

Bpx hmemcpy

Close the debugger window and hit OK, Bang! We are kicked straight back into our debugger, so trace through to the second instance of the program code, and the first thing we notice is;

Uniview! UPX 0+35CCA

This tells us that the program has been packed with UPX (Ultimate Packer for eXecutables). This information could come in handy, as you will see later on. Back to work! Trace through the program code and eventually you should see the following;

004DE29B CALL 00403DE0

004DE2A0 MOV EAX, [004F98D8]

004DE2A5 MOV EAX, [EAX]

004DE2A7 MOV EDX, [EAX]

004DE2A9 CALL NEAR [EDX]

004DE2AB TEST AL, AL < Is AL = 1 (Correct Serial) , or is AL = 0 (Bad Serial)

004DE2AD JZ 004DE2EA < If AL = 0, jump to “ Bad Cracker “, or else carry on to “ Good Boy “

Because our serial is fake, AL = 0 , and the conditional jump takes us here;

004DE2EA PUSH BYTE +10

004DE2EC MOV ECX, 004DE394

004DE2F1 MOV EDX, 004DE39C < Type D ECX to see “ Bad Cracker “ text

If we typed D ECX at to show the contents of ECX, you should see “ Error…Invalid Registration Code! “ in the data window. This tells us that the conditional jump at 4DE2AD determines whether we get the Bad Cracker or Good Boy messages. Hmm, lets try a simple code change (I did fish round for a real serial, but couldn’t find one!). Why not change the JZ at 004DE2AD into a JNZ? This would mean that we would only receive the Bad Cracker message if we entered the CORRECT serial!

Right, lets disassemble the damn thing. Open up W32Dasm, and start disassembly. OW! It crashes the disassembler. Remember what we found out earlier? The program is protected by UPX! So we need to unpack the protected executable before we can disassemble it. Now we have two options;

1.Use UPX itself with the – d option (disassemble), but I know that the .exe can be protected from this (using eg UPX Scrambler RC), so I used Plan B;

2.ProcDump.

Run ProcDump, and click on the unpack button. You will then be prompted to select an unpacker, so scroll down, select UPX, and hit the OK button. ProcDump will then ask you to select the file you wish to unpack, so browse to the location containing uniview.exe, select it, and hit Open. The target program will now start up, so minimise it ( do not exit! ), and you will see a message, hit OK, and you will be asked to name a file for saving, which I called uniview2.exe. Hit OK, and you should now have an unpacked executable in the installation folder!

Get W32Dasm, and disassemble our freshly unpacked uniview2.exe. It Works! If we open up the String Data References box and look for our invalid code text, we wont find it because the program is written in Delphi! This wont stop us because we already know the location of the JZ in question, so go to the code location 004DE2AD, and what do we see? Our conditional jump! Make a note of the hex offset of the location (DD8AD), close W32Dasm, open your hex editor, and open Uniview2.exe.

Go to the hex offset for the JZ in question and change 743B to read 753B (74 is the hex value for JZ, and 75 is the hex value for JNZ). The line of code will now look like;

004DE2AD JNZ 004DE2EA

Save the newly modified program, and lets try this baby out!

Open up Uniview and re-enter the registration information;

Name: anTiHerO

Serial: 1212121212

Click OK, “ Thank you for Registering….” !!!! Are we finished? Most programs check the serial from the registry upon startup, meaning that you can register it by putting in any old serial, but once you close the application and re-open it, it will be unregistered again until you enter a serial again! Lets Try. Close Uniview, set the system clock forward past the 30 days, then re-open it. STILL REGISTERED!!!! Our job is done.

Note: If you want to unregister the program, you will find the following location useful;

HKEY_CURRENT_USER\UNIVIEW\REGISTER

Have FUN!!!!!

Final Notes

Pat yourself on the back, grab a beer and a cigar, and relax, safe in the knowledge that you just learnt something usefull!!

My Greetz Goes to:

[T]urb0z – For introducing me to these infernal machines

The TRES2000 Crew
My mum

When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride
McCodEMaN

ObDuh

The information in this essay is for educational purpose only!
You are only allow to crack, reverse engineer, modify code and debug programs that you legaly bought and then for personal use only!!
To ignore this warning is a criminal act and can result in lawful actions!

So please note!
I take no responsibility for how you use the information in this essay, i take NO responsibility for what might happen to you or your computer!
You use this information on your own risk!!

What I mean is: Please buy the software!

ProcDump 1.6.2

My Greetz Goes to:

When ever there is a door, there is an entrance. And behind an entrance can no secret hide, when a cracker takes his knowledge for a ride McCodEMaN

When ever there is a door,
there is an entrance.
And behind an entrance can no secret hide,
when a cracker takes his knowledge for a ride
McCodEMaN