Cracking SendMail 2.0 for Windows NT
(Obvious Name Protections)

by Flipper (upg)


(24 September 1997)

---

Courtesy of fravia's page of reverse engineering

Well, here is Flipper's email:

Fravia,

  I have written another essay, but I hope you can use it under the 1997 HCU
training exercises. It has a date check, in a DLL file which uses obvious to
spot names like 'ValidateTrial', etc. Once again, I only used Hiew and wdasm
8.5 -- no softice. It also contains an explanation of how if..then..else
statements are compiled in C for Windows. I hope you can find a spot on your
page to stick it.

flipper (upg)

This time around, our target is Metainfo's SendMail 2.0 for Windows NT. The
trouble with reverse engineering this software is that you must be running
Windows NT Server to install and configure it. I was running NT Server, but
couldn't get my DNS address verified -- I had hit a brick wall. Now, all that
was left was a dead listing approach without the actual program installed on
my machine.

I had a friend install it on an internet connected NT Server machine, and I
copied the file SENDMAIL.EXE onto a disk. This was just the beginning.

Tools You'll Need:

1. Windows Disassembler 8.5 or above
2. Hiew 5.65
3. A copy of SendMail 2.0 Build 2144 for Windows NT Server.
   [it can easily be found at http://www.metainfo.com/]

First things first. I had no idea what would happen if I had set the clock
ahead after SendMail was installed, so back I went to my friend's place to
see what would happen. The software works for 30 days, and then the trial
key expires. Thus, the service will start, but anyone trying to access the
SMTP port will get a nice message stating that the software has expired.

If you enter an invalid key, it will bring up a message box saying the all
too familiar phrase, "Invalid Key."

So, let's get a dead listing of SENDMAIL.EXE. After looking through the code
for string references and the like, you'll come up with absolutely nothing.
How can this be? Well, all this means is that those strings are contained
in a dynamic link library (dll) file. So, do we find out what file those
strings are stored in? Simple.

Load up SENDMAIL.EXE (assuming you could either get a copy, or installed it
yourself) with Hacker's View. Press F7 and search for the string "Invalid
Key". No luck there, so try "expired". Finally, a match -- now I know what
you are saying, 'but you said there was no string reference to this phrase
in the dead listing, flipper old pal..'. I did say that, but sometimes the
dead listing does not reveal all that lies beneath the code.

By just looking at the code from Hiew, we can see what file those nasty
strings are being held in.

.0005D010:  49 6E 76 61-6C 69 64 20-73 65 72 69-61 6C 20 6E  Invalid serial n
.0005D020:  75 6D 62 65-72 20 6F 72-20 74 72 69-61 6C 20 74  umber or trial t
.0005D030:  69 6D 65 20-65 78 70 69-72 65 64 00-53 4D 00 00  ime expired SM
.0005D040:  46 73 64 61-68 36 37 61-6E 76 63 00-53 4F 46 54  Fsdah67anvc SOFT
.0005D050:  57 41 52 45-5C 4D 65 74-61 49 6E 66-6F 5C 53 65  WARE\MetaInfo\Se
.0005D060:  6E 64 6D 61-69 6C 00 00-66 31 32 33-2D 34 35 36  ndmail  f123-456
.0005D070:  32 2D 30 33-36 31 2D 31-32 33 34 00-43 61 6E 6E  2-0361-1234 Cann
.0005D080:  6F 74 20 6C-6F 61 64 20-6D 65 74 61-63 70 31 30  ot load metacp10
.0005D090:  2E 64 6C 6C-00 00 00 00-47 65 74 54-72 69 61 6C  .dll    GetTrial
.0005D0A0:  49 6E 73 74-61 6C 6C 54-69 6D 65 00-56 61 6C 69  InstallTime Vali
.0005D0B0:  64 61 74 65-53 65 72 69-61 6C 00 00-49 6E 69 74  dateSerial  Init
.0005D0C0:  52 65 67 69-73 74 72 61-74 69 6F 6E-00 00 00 00  Registration
.0005D0D0:  6D 65 74 61-63 70 31 30-2E 64 6C 6C-00 00 00 00  metacp10.dll

How interesting these lines above are. Look at what we have in the above
listing, and you'll see how powerful a hex editor can be.

1. We have the phrase we searched for at 5D010 (all addresses are in 32 bit
   DWORD format)

2. At 5D040 we have the location in the registry where the serial number
   will be stored (SOFTWARE\MetaInfo\Sendmail)

3. Loo and behold, we even have a reference to the Demo License serial number
   at 5D060.

4. At line 5D080 we now know the name of the dll that is being called :-)

5. And to make our job even easier, we also have the names of all of the
   functions called in order to check the serial number at line 5D090.

With all this, we should be able to crack this program in about ten minutes.

First, find the file METACP10.DLL. It should be located in your Windows NT
'System32' directory. Once you have that file, get a dead listing of it
right away. One of the reasons I use dead listings so much is that SoftIce
for Windows NT is a pain to setup, and I don't want to restart the computer
just to get rid of a little date check ;->

All right, what should we search for in the METACP10.DLL dead listing? Simple,
anything that leads us to the protection scheme. Such words as 'Expired Key'
and 'Invalid Key' come to mind.. as well as 'Registered', 'Days in use', and
'ValidateSerial'.

Let's begin with 'ValidateSerial', since we know this function was called
from inside SENDMAIL.EXE. Now stop for a moment; the name of this function
gives it away, and if you look further into the METACP10.DLL file, you'll
come across similar functions, with down to earth, easy to understand names.

Here's what I came across when I searched for that phrase.

* Referenced by a CALL at Addresses:10001D82   , :10001E2B
|
Exported fn(): ValidateSerial - Ord:001Fh
:10001673 55                      push ebp
:10001674 8BEC                    mov ebp, esp
:10001676 83EC0C                  sub esp, 0000000C
:10001679 837D0800                cmp dword ptr [ebp+08], 00000000
:1000167D 7408                    je 10001687
:1000167F 8B4508                  mov eax, dword ptr [ebp+08]
:10001682 8945F8                  mov dword ptr [ebp-08], eax
:10001685 EB07                    jmp 1000168E

Aha, we've stumbled upon a goldmine. There are only two places where this
function is called from. Now, there are two possible ways to crack this
software. One way is to assume the user has left the demo key as is, and
the program will expire normally, and the other is to allow the user to enter
any key they want, and then the program will report an invalid key.

The easiest way (and most rewarding way) to do this crack is to choose the
second way, but I will leave that as an exercise for the more advanced
cracker. For time's sake, we'll take the easy way out, and a way out that
will let you make a crack that any user can use.

Let's follow this procedure through, and see where it takes us. At 1000167D
we see a jump if ebp+08 is equal to 0. If that's the case, it takes us to
this piece of code.

:10001687 C745F848140110          mov [ebp-08], 10011448

So, if epb+08 is equal to zero, then epb-08 will now equal 10011448, which
is not a pointer, so it will not show up in the dead listing.

Back to the function, it will eventually jump to 1000168E. We find..

* Possible StringData Ref from Data Obj ->"f123-4562-0361-1234"
                                  |
:1000168E 6874E00010              push 1000E074
:10001693 8B4DF8                  mov ecx, dword ptr [ebp-08]
:10001696 51                      push ecx
:10001697 E8042B0000              call 100041A0
:1000169C 83C408                  add esp, 00000008
:1000169F 85C0                    test eax, eax         
:100016A1 7509                    jne 100016AC          ; ref to ValidateBomb
:100016A3 6A00                    push 00000000
* Reference To: METACP10.ValidateTrial
                                  |
:100016A5 E847010000              call 100017F1
:100016AA EB37                    jmp 100016E3

So there is our reference to the demo serial number, and finally a call
to a function called 'ValidateTrial'. I spent a good deal of time looking
through each of these procedures, and I won't dwell too deeply on them here,
but if you trace 'ValidateTrial' to 100017F1, you'll run into another good
function name, 'ValidateBomb'. Suffice it to say, we don't want this program
to ever reach the 'ValidateBomb' phase, so the crack is very clear now.

Well, we don't want to jump to a procedure that calls 'ValidateBomb', so we
simply remove that jump alltogether from 100016A1.

:100016A1 90                      nop
:100016A2 90                      nop

That should take care of the first check, and now onto the second check.

:100016A5 90                      nop          
:100016A6 90                      nop
:100016A7 90                      nop
:100016A8 90                      nop
:100016A9 90                      nop

I know this method is horrible, and a nicer way is to use inc ax, dec ax
instead, but I only patched it this way to show you how this program uses 
simple plain English names for every function, and in that respect, making 
it very easy to jump around, or complete cut them out.

The above patch will properly crack this software, and the demo key will now
work as if the program is in registered mode. However, I'm not done yet. I
have one more thing to show you about the wonderful dll we are cracking.

Search for the word 'Registered' in the dead listing. You should end up at
line 10001ED1. If you look below, there are 5 different possibilities that
a serial key can force the program to report. These five 'blocks' of code
are set one after another without a call or jump reference above them. This
is very interesting indeed. Let's have a look at the code just above 10001ED1
for a moment.

The five keyfile 'modes' are as follows. Registered, Trial Key, Expired Key,
Invalid Key, and Intermediate (hmm..)

* Referenced by a Jump at Address:10001E37(C)
|
:10001EA5 833D4816011000          cmp dword ptr [10011648], 00000000
:10001EAC 0F858B000000            jne 10001F3D
:10001EB2 8B55FC                  mov edx, dword ptr [ebp-04]
:10001EB5 8995A8F6FFFF            mov dword ptr [ebp+F6A8], edx
:10001EBB 83BDA8F6FFFF04          cmp dword ptr [ebp+F6A8], 00000004
:10001EC2 7774                    ja 10001F38
:10001EC4 8B85A8F6FFFF            mov eax, dword ptr [ebp+F6A8]
:10001ECA FF2485AB200010          jmp dword ptr [4*eax + 100020AB]

Look at the last line of code, at line 10001ECA. This is a very unique jump
indeed. It translates as JUMP to a 32 BIT ADDRESS, which is the value of EAX
multiplied by 4, plus the DWORD (pointer) value of 100020AB.

At 100020AB we find this piece of code.

:100020AB D11E0010                DWORD 10001ED1

So, FOUR times the value of EAX plus DWORD 10001ED1.. that sounds like a
jump to this following bit of code..

* Possible StringData Ref from Data Obj ->"Registered"
                                  |
:10001ED1 6804E10010              push 1000E104
:10001ED6 8B4D0C                  mov ecx, dword ptr [ebp+0C]
:10001ED9 51                      push ecx
:10001EDA 8B5508                  mov edx, dword ptr [ebp+08]
:10001EDD 52                      push edx

How interesting. So, if the line before the jump inserts a value into EAX,
it makes no matter what it is, then we can assume that this very interesting
jump routine is an if then else structure, very well compiled.

:10001EC4 8B85A8F6FFFF            mov eax, dword ptr [ebp+F6A8]

Now, let's assume for a moment that the structure looks something like this
in C.

 if (RegFlag == 1)
 {
  .. this program is registered, set other flags, jump, etc. ..
 }
 else (RegFlag == 2)
 {
  if (DaysInUse > 30)
  {
   exit(0);
  }
 }

And it continues like this for the next three options. So, using a bit of
logic, we can come to the conclusion that if EAX would somehow equal ZERO,
zero multiplied by four is STILL ZERO, plus 10001ED1 would make this program
jump to what's at 10001ED1, which is the correct address for the 'Registered'
mode string.

Simply change the instruction at 10001EC4 to

:10001EC4 33C0                    xor eax, eax             ; set eax to ZERO
:10001EC6 90                      nop
:10001EC7 90                      nop
:10001EC8 90                      nop
:10001EC9 90                      nop

Alas, this only controls the text display, so the program will still not work
after thirty days ;-) but it makes for interesting reverse engineering, as
this code is compact, and written very well.

Final notes? Well, I only had to use two tools to accomplish this job, and
one of them wasn't softice. Hiew does such a nice job of 32 bit addressing
that I find it does the job without the need for debugging at all. SendMail
is an excellent e-mail server, and since most high priced Windows NT programs
need to be written as efficiently as possible, most NT programs tend to use
a lot of compact code, as we've seen here.

Oh, and one final warning about this program. If you try and disassemble any
of the files mentioned here in Windows NT, wdasm32 just crashes and your
computer will record a memory access violation. To get a dead listing, use
Windows 95 instead.

written by flipper (upg) on 09/21/97.

Back to Project 7 ("Most stupid protection")
homepage links anonymity +ORC students' essays academy database
tools cocktails antismut CGI-scripts search_forms mail_fravia
Is reverse engineering legal?