EnTray-Vous, Merci
Or, "How NOT to use the Registry to protect your software"

by Mammon_

(27 August 1997)

---

Courtesy of Fravia's page of reverse engineering

Well, here is the letter I got from the author:

Fravia:  
 
I'm not much one for contributing essays, but this has got to be the
stupidest protection scheme I have ever come across. I cracked this program at
work in under 3 minutes, breaking my previous record with QuickViewPlus 4.0 ( a
5 or so minute BMSG approach done while on the phone...very expedient ;),
and was so shocked by the poor programming in terms of security and in general
that I had to stop using the program. I passed it on to another aspiring
cracker and told him to crack it without w32dasm or Soft-Ice as an exercise... 

 
 
Target: EnTray Version 1.3, by Ashkay R 
EXE Size: 48.5 K 
Zip File: 661.8 K 
Distribution: Tucows (http://207.155.78.240/files/entray13.zip) 
 
The protection scheme used on this software was so simple to defeat that I 
am embarassed to even be writing about it; in fact it has so diminished my
respect for the programmer that I cannot bring myself to even use the 
software anymore.  
And what software is this? 
 
It is EnTray, a program which, like TrayIcon, allows you to put any
shortcut you like (for example, the Soft-Ice Symbol Loader or BaseCalc) on 
your TaskBar. 
It is shareware, and very easy to use... even easier to configure than 
TrayIcon. The program is 48.5 K and comes with a 987K .dll file (mfc42.dll, 
hmmm, what could this have been written using-- Delphi? Pascal? No wait, I'll 
get it, hold on...) -- as far as I'm concerned, yet another reason to use 
"static" instead of "shared" libraries when compiling MFC (or any C++/VB) 
applications. There is no reason a program with a max size of maybe 100K 
should be distributed with over 1 MB of binary files. 
 
Every detail of an application is a clue as to how to crack it. I took the
marriage of a 987K .dll with a 49K .exe to indicate that I would need neither
Soft-Ice nor W32DASM. 
The biggest lesson to be gained from EnTray is to never make things more  
complicated than they need be. 
 
Stage 1: Information gathering 
 
EnTray comes with numerous help files in HTML format (another sign...); 
I only bothered to unzip REGN.HTM, in which the author states: 
  
"On receipt of your registration request, I will send you a registration 
program which you will need to run in order to register EnTray to your name. 
The registered version differs from the downloadable version in only two
respects : 
  The About Box does not appear on starting up EnTray and EnTray silently 
  installs itself; 
  The About Box (when you choose to bring it up) acknowledges that your 
  copy of EnTray is licensed to you."
  					 
When you run Entray, a small nag screen pops up telling you that the
software is UNREGISTERED. The first thing that comes to mind is to kill the 
nag screen with a resource editor; but BRW gives an "Unknown File Format" 
error, and Symantec Resource Studio gives an "Invalid Bitmap Header" error--
probably due to calls in the MFC .dll. 
Next step: right-click on EnTray.exe and choose QuickView, scroll down to
the Imports Section. Hmmm, MFC, MSVCRT (MS Visual C++ Runtime Library), Kernel, 
User, GDI, and...  ah, ADVAPI32.DLL, infamous for its registry access calls. 
Sure enough, EnTray imports 
RegCreateKeyExA, 
RegSetValueExA, 
RegQueryValueExA, and 
RegOpenKeyExA. 
Door #1 is therefore the 95 Registry. 
 
Stage 2: Runtime Monitoring 
 
The best thing to do when a program accesses the Registry is, of course, 
to run  RegMon, which gives us the following output: 
 
30435 OpenKey      LOCAL\Software\Akshay\Entray\1.0      SUCCESS 
30436 QueryValueEx LOCAL\Software\Akshay\Entray\1.0\REG  NOT FOUND 
 
This seems fairly straightforward: EnTray is looking for a value named
"REG" in HKEY_LOCAL_MACHINE\Software\Akshay\Entray\1.0, and as the 
program is not registered it is not finding it. 
So using RegEdit, create a string value in the above key, name 
it REG and give it a value of 1 for "True". 
 
Restart EnTray...Bingo! No nag screen. Your product is now registered. 
 
Stage 3: Disgust 
 
Granted, this pretty weak protection scheme is for a program that was 
probably written more for personal use that for commercial distribution; 
I can accept that.  
But, the one criticism I will offer before deleting the program from my
system: try at least to be less than obvious...if nothing else, DO NOT call 
the "magic registry key" REG -- call it MRU or WindowPos, or HCU, and put it 
in HKEY_CURRENT_CONFIG/Display/Settings or any other key that the system accesses 
frequently; the HKLM/Software key added by your program should only contain 
settings regarding user preferences and file locations, not the key to 
your whole protection scheme. 
 
_m 
 

Project 7
homepage links anonymity +ORC students' essays academy database
tools cocktails antismut CGI-scripts search_forms mail_fravia
Is reverse engineering illegal?