A new kind of protections ?
|
| |
Design your own CPU !!
|
|
| by anormal/kindergarten |
.Index.
1. intro, ideas, etc...
2. first example: stup8CPU
3. second example: memoCPU
4. closing words: greetings, stupid things, etc...
1. intro, ideas, etc...
hey you!: What are you doing?, let me guess it... sitting comfortably in your chair, looking at the screen of your display, reading the new essays from fravia???. Maybe with a glass of your favorite drink?(remember more caffeine means more power!!!, so get a jolt cola now!!!), and listening to some deep and relaxing ambient music (let me recommend you: "lifeforms" or "isdn" from future sound of london, "ghost in the shell" original sound track, or some of the goldieīs CDs: "timeless", "saturnzreturn").
Fraviaīs is a nice site, isnīt it???. He, he... well in this essay iīll try to show you a new kind of protection scheme. I say "new", because i only have seen this one 3 times, iīll explain this later. Through this text, we are going to learn how design and implement our own cpus, of course in software.
A new CPU?. Yes, let me explain the main points of this idea:
1. Design the architecture of a new cpu: number of registers, kind and usage of memory, opcodes and special functions, like ports for accessing external devices, etc.
2. Write a emulation of this CPU for intel x86 machines (or motorola, or whatever ...). We could code this emulation in assembler, c, lisp, basic, etc... I think a big overbloated compiler (like visual basic) will generate enough tons of code to keep our crackers happy for a while, of course, the two examples in this essay are coded in hardcore assembler.
3. Code the protection scheme: keyfiles, passwords checks, hashing cryptography schemes, etc..., in the assembler language of the emulated cpu.
4. Compile the protection, with our own compiler, assembler, etc, and ...
5. Execute the protection scheme under the emulator.
Nice, eh?. Iīm sure you got the point.
I think this is a good protection, because we hide the real protection scheme under tons of bastard code. The well learn scheme cmp var,1 - jne go_beggar, will be hidden deep inside the kernel of the emulator. The only defense we have against a cracker is trying to bore him, if he get bored tracing tons of stupid code heīll give up.
Some advantages are: extensibility: we could code different protections in seconds. Portability: just coding the emulator for a different system, unix, macs, etc, we can execute the "same protection" in a portable fashion.
Weak points: the cracker could reverse engineer the emulator, guess how the cpu works, make a dissasembler, and ... , you could guess the rest. Funny, eh?
A solution: we must code emulator for the cpu to be very hard to understand. Itīs a lot harder to patch the code in this way, remember that the opcodes of the cpu are emulated in a confusing way. The cracker must patch the emulated code, not the emulator. He first need to build a disassembler or, at last, know very well the inner working of the CPU.
Letīs see the examples.
2. first example: stup8CPU
In this example we are going to design a cpu with this features(?):
-------------------------
project name: stup8cpu
por: anormal/kindergarten
-------------------------
:description:
-------------
registers:
1 accumulator (8 bits)
1 index (8 bits)
memory:
0..................31....................255 bytes
[-- idx to inm ---][----- code + data -----]
[------------ 256 bytes of ram ------------]
:opcodes:
---------
pnemonic type opcode meaning
------------------------------------------------
mov idx,@inm arith 010 (2) load a number in index register
load arith 001 (1) load accumulator with contents of [idx]
sub acc,@inm arith 011 (3) accumulator-=inm
inc idx arith 000 (0) inc idx
output ctrl 101 (5) print accumulator in screen
input ctrl 110 (6) input bytes from keyboard and put them in [idx] 0 terminated
jnz @label ctrl 111 (7) jmp to label if accumulator is <> 0
stop ctrl 100 (4) stop the cpu
:notes:
--------
this cpu has 2 8bits registers: 1 accumulator and 1 index.
it has a total memory of 256 bytes.
the first 32 bytes of memory are used to store inmediates. So, the total amount of diferent
inmediates in a program are 32. Every opcode is coded in just 1 byte, the opcodes that works
with inmediates, donīt have the inmediate in the byte, they only have an index to the first 32 bytes
Do you understand?.
We have 8 different opcodes. So we need only 3 bits of opcodes. We use the rest 5 bits to code the
index to the inmediates zone.
Putting an index to inmediates zone in an opcode that doesnīt use index (like the stop) causes
not effect.
After the cpu is powered on, the initial program counter is just after the inmediateīs zone.
:example protection in the asm code of the emulated cpu:
--------------------------------------------------------
mov idx,messini ;point idx to message
print1:
load ;load a byte from message
sub acc,key0 ;decode byte of message
inc idx ;to get next byte
output ;print the char in the screen
jnz print1 ;loop
mov idx,pass
input ;get a string from keyboard
load ;get char
sub acc,key1 ;sub key1
jnz bad ;itīs <>0 then is bad,
inc idx
load
sub acc,key2 ;etc..
jnz bad
inc idx
load
sub acc,key3
jnz bad
inc idx
load
sub acc,key4
jnz bad
inc idx
load
sub acc,key5 ;weīll put 1 check for every letter in the password
jnz bad
inc idx
mov idx,messok ;right password
print2:
load
inc idx
sub acc,key6 ;print message
output
jnz print2
stop ;stop cpu
bad:
mov idx,messbad ;bad password
jnz print2
:emulation:
-----------
notes: - bx points to the position 0 of the emulated ram
- al contains the actual opcode to be emulated
- ip of the emulated cpu is hold in si
The inner working of this emulation is very easy.
Main loop of the emulator:
start:
mov bx,offset ram ;points bx to emulated ram
mov si,offset ram+32d ;initial ip
run:
lodsb ;load opcode
mov di,ax
and di,0111b ;get instruction
shl di,1
add di,offset optable
call [di] ;emulate!
endemul:
jmp run ;get next opcode
The procedures use to emulated the different opcodes are:
movidx:
shr al,3
xlat ;al=bx+al, with this we get an inmediate
mov idx,al
ret
load:
mov al,idx
xlat
mov acc,al
ret
subacc:
shr al,3
xlat
sub acc,al
ret
incidx:
inc idx
ret
output:
mov dl,acc
mov ah,02
int 21h
ret
input:
mov dx,offset buffer
mov ah,0ah
int 21h
mov al,idx
sub ah,ah
mov di,ax
add di,bx
xchg ax,si
mov si,offset buffer+2
xor cx,cx
mov cl,[buffer+1]
rep movsb
xchg ax,si
ret
jnzlabel:
cmp acc,0
jne jump
ret
jump:
sub ah,ah
shr al,3
xlat
mov si,ax
add si,bx
ret
stop:
pop ax
ret
Ok, i wish you understand all.
The only thing that is missing itīs how we are going to compile the protection, and how to use
the language.
Well, very simple, weīll use macros in turbo assembler to build the opcodes in memory.
Look at this:
; opcode macronization :)
_inc_idx macro
db 0 ;opcode=0
endm
_load macro
db 1 ;opcode=0
endm
_mov_idx macro idx_inm
db 2 or (idx_inm shl 3) ;opcode=2 + index
endm
_sub_acc macro idx_inm
db 3 or (idx_inm shl 3) ;opcode=3 + index
endm
_stop macro
db 4 ;opcode=4
endm
_output macro
db 5 ;opcode=5
endm
_input macro
db 6 ;opcode=6
endm
_jnz macro idx_inm
db 7 or (idx_inm shl 3) ;opcode=7 + index
endm
This is complete source code. Just do tasm /m2 stup8cpu.asm and a tlink /t stup8cpu.obj to compile it.
; ------------------------------------------------------------------------
; project: stup8cpu
; code: anormal/loki/kindergarten/trkitzr
;
; rev: 0.000 : Sun 02-08-1998 : initial code, not debug
; rev: 0.001 : Sun 02-15-1998 : some fixes, some debugging
; rev: 0.002 : Sun 02-22-1998 : +debugging
; i was getting a stupid error due to the use of si without initializating
; time: 0.000 : 1:30
; time: 0.001 : 1:10
; time: 0.002 : 2:10
c0de segment
assume cs:c0de,ds:c0de
org 100h
.486
; opcode macronization :)
_inc_idx macro
db 0
endm
_load macro
db 1
endm
_mov_idx macro idx_inm
db 2 or (idx_inm shl 3)
endm
_sub_acc macro idx_inm
db 3 or (idx_inm shl 3)
endm
_stop macro
db 4
endm
_output macro
db 5
endm
_input macro
db 6
endm
_jnz macro idx_inm
db 7 or (idx_inm shl 3)
endm
start:
mov bx,offset ram
mov si,offset ram+32d ;initial ip
run:
lodsb ;load opcode
mov di,ax
and di,0111b ;get instruction
shl di,1
call [di+offset optable]
endemul:
jmp run
db 0bfh
movidx:
shr al,3
xlat
mov idx,al
ret
db 0bah
load:
mov al,idx
xlat
mov acc,al
ret
db 0eah
subacc:
shr al,3
xlat
sub acc,al
ret
db 0bah
incidx:
inc idx
ret
db 0cdh
output:
mov dl,acc
mov ah,02
int 21h
ret
acc db 0
input:
mov dx,offset buffer
mov ah,0ah
int 21h
mov al,idx
sub ah,ah
mov di,ax
add di,bx
xchg ax,si
mov si,offset buffer+2
xor cx,cx
mov cl,[buffer+1]
rep movsb
xchg ax,si
ret
idx db 0
jnzlabel:
cmp acc,0
jne jump
ret
db 0b2h
jump:
sub ah,ah
shr al,3
xlat
mov si,ax
add si,bx
ret
db 0b8h
stop:
pop ax
ret
buffer db 20h,0
db 20h dup (0)
db 0eah
optable dw incidx,load,movidx,subacc,stop,output,input,jnzlabel
;ram!!!
;vector of pointers to real inmediates
ram db iniMess-ram ;0
db imprime-ram ;1
let_o db 'o' ;2
db pass-ram ;3
db badtry-ram ;4
let_u db 'u' ;5
db okMess-ram ;6
db badMess-ram ;7
let_l db 'l' ;8
db imprime2-ram ;9
let_r db 'r' ;10
let_p db 'p' ;11
db 32-12 dup(0)
_mov_idx 0
imprime:
_load
_sub_acc 10 ;decode message
_inc_idx
_output
_jnz 1 ;must be 'r' terminated, so 'r'-'r'=0 and the loop ends
_mov_idx 3
_input
_load ;the algorithm for checking the password is very, very, very, very simple :)
_sub_acc 8 ;well, it really is pure crap
_jnz 4 ;we only compare letter to letter, if not is equal then go_beggar! :)
_inc_idx
_load
_sub_acc 5
_jnz 4
_inc_idx
_load
_sub_acc 11
_jnz 4
_inc_idx
_load
_sub_acc 5
_jnz 4
_inc_idx
_load
_sub_acc 8
_jnz 4
_inc_idx
_load
_sub_acc 2
_jnz 4
_inc_idx
_mov_idx 6
imprime2:
_load
_inc_idx
_sub_acc 8
_output
_jnz 9
_stop
badtry:
_mov_idx 7
_jnz 9
pass:
db 23,93,83,25,73,83,91 ;just some trash
;we could encode this strings with a irp or irpc macro in tasm, but iīve prefered to do it so for the sake
;of clarity, just use a good editor with columns to fill all that. One of my favorites is Boxer 7.5.
iniMess:
db 0ah + 'r'
db 0dh + 'r'
db 's' + 'r'
db 't' + 'r'
db 'u' + 'r'
db 'p' + 'r'
db '8' + 'r'
db 'C' + 'r'
db 'P' + 'r'
db 'U' + 'r'
db ' ' + 'r'
db 'b' + 'r'
db 'y' + 'r'
db ' ' + 'r'
db 'a' + 'r'
db 'n' + 'r'
db 'o' + 'r'
db 'r' + 'r'
db 'm' + 'r'
db 'a' + 'r'
db 'l' + 'r'
db '/' + 'r'
db 'k' + 'r'
db 'i' + 'r'
db 'd' + 'r'
db 'e' + 'r'
db 'r' + 'r'
db 'g' + 'r'
db 'a' + 'r'
db 'r' + 'r'
db 't' + 'r'
db 'e' + 'r'
db 'n' + 'r'
db ' ' + 'r'
db '-' + 'r'
db ' ' + 'r'
db 'f' + 'r'
db 'e' + 'r'
db 'b' + 'r'
db '-' + 'r'
db '9' + 'r'
db '8' + 'r'
db 0ah + 'r'
db 0dh + 'r'
db 'E' + 'r'
db 'n' + 'r'
db 't' + 'r'
db 'e' + 'r'
db 'r' + 'r'
db ' ' + 'r'
db 'p' + 'r'
db 'a' + 'r'
db 's' + 'r'
db 's' + 'r'
db 'w' + 'r'
db 'o' + 'r'
db 'r' + 'r'
db 'd' + 'r'
db ':' + 'r'
db ' ' + 'r'
db 'r' ;terminator
okMess:
db 0ah + 'l'
db 0dh + 'l'
db 'n' + 'l'
db 'i' + 'l'
db 'c' + 'l'
db 'e' + 'l'
db '!' + 'l'
db '!' + 'l'
db '!' + 'l'
db '!' + 'l'
db ',' + 'l'
db ' ' + 'l'
db 'e' + 'l'
db 'm' + 'l'
db 'a' + 'l'
db 'i' + 'l'
db 'l' + 'l'
db ' ' + 'l'
db 'm' + 'l'
db 'e' + 'l'
db ' ' + 'l'
db 'n' + 'l'
db 'o' + 'l'
db 'w' + 'l'
db '!' + 'l'
db '!' + 'l'
db ' ' + 'l'
db 't' + 'l'
db 'o' + 'l'
db ' ' + 'l'
db 'a' + 'l'
db 'n' + 'l'
db 'o' + 'l'
db 'r' + 'l'
db 'm' + 'l'
db 'a' + 'l'
db 'l' + 'l'
db '@' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db 'x' + 'l'
db '.' + 'l'
db 'c' + 'l'
db 'o' + 'l'
db 'm' + 'l'
db 0ah + 'l'
db 0dh + 'l'
db 'l' ;terminator
badMess:
db 0ah + 'l'
db 0dh + 'l'
db 'w' + 'l'
db 'r' + 'l'
db 'o' + 'l'
db 'n' + 'l'
db 'g' + 'l'
db '!' + 'l'
db ',' + 'l'
db ' ' + 'l'
db 't' + 'l'
db 'r' + 'l'
db 'y' + 'l'
db ' ' + 'l'
db 'a' + 'l'
db 'g' + 'l'
db 'a' + 'l'
db 'i' + 'l'
db 'n' + 'l'
db ' ' + 'l'
db 'm' + 'l'
db 'a' + 'l'
db 'n' + 'l'
db '!' + 'l'
db '.' + 'l'
db '.' + 'l'
db '.' + 'l'
db 0ah + 'l'
db 0dh + 'l'
db 'l' ;terminator
c0de ends
end start
3. second example: memoCPU
Ok. Are you ready for the second example?, open your eyes because this is a bit more complicated than the first one.
This cpu is a bit special. It only has memory. No registers. Why?, well, i donīt know, i just designed so. Call it inspiration or whatever you want.
memory
--------
0ffh bytes
after cpu reset, i.e. at startup, the initial program counter will be 0.
so weīll put our code at beginning of ram.
registers
----------
sorry, no registers.
in fact, the only problem will be how to implement indexes, this is solved through the mov opcode.
opcodes
-------
an opcode is 4 bytes long, formed by opcode,param1,param2,next_ip
opcode is the number of the opcode.
param1, param2 are parameters of the opcode.
and next_ip??, hehehe, this is feature i added after reading one of the apendixes in the nice
"The jargon file", a compendium of words related to hacker (sub)culture, read it to get true
knowledge from the real ancient masters.
let me explain, next_ip is the position of the next opcode to be executed, eh?, yeah, in the x86
architecture, the next opcode is the next after the actual opcode. but my cpu is crazy like rats, so
it let you to expecify the next opcode. Think a bit on this, we could create a web execution, a
labyrinth of opcodes, jumping up and down though memory. A total knigtmare for the cracker!!!.
in the examples i havenīt used this feature, i donīt want you to get crazy. Just know that
feature and use it when you want.
opcode pnemonic param1 param2 next_ip meaning
--------------------------------------------------------------------------------
0 xor orig1 ,dorig2 ,next_ip xors dorig2 with contents of orig1
2 add orig1 ,dorig2 ,next_ip adds contents of orig1 to dorig2
4 inp dest, ,cnt ,next_ip input cnt bytes from keyboard and put them in dest,
cnt is updated with the number of bytes read
6 out orig ,nil ,next_ip display char in orig
8 mov @orig ,dest ,next_ip movs uses at double indirection, done so to implement
indexes, mov contents of address pointed by orig to dest
a stp nil ,nil ,nil stop cpu
c jnz orig1 ,next_ip1,next_ip2 if contents of orig1<>0 jmp to ip1 else to ip2
i am sure you understood all the opcodes, if not reread them.
this is the initialization and main loop of the emulator:
sub eax,eax
sub cx,cx
sub dx,dx
mov si,offset memory ;si will be used like program counter, initially points to position 0
mov di,si ;di is used to acces the memory,
sub bx,bx
nextCycle:
mov eax,[si] ;get opcode from next_ip
mov bl,al
call [bx+offset opcodeTable]
shr eax,8 ;the next_ip is in the 1st byte of eax
mov si,ax ;si=next_ip
add si,di ;+initial offset
jmp nextCycle
very simple, just get an opcode in eax, and call the emulation procedure for that opcode.
after returning from the call, the hi word of eax will be in ax, so shr eax,8 puts the next_ip
opcode in al, we put it in si and loop!
letīs see the emulation procedures of each opcode, and the associated table of offsets to them.
;emulation procedures ----------------------------------------------------
opXor:
mov bl,ah ;get orig1
mov cl,[bx+di] ;get value of orig1, remember di is always pointing to begining of memory
shr eax,16 ;to get orig2, and next_ip
mov bl,al ;get orig2
xorit:
xor [bx+di],cl ;xor it
ret
opAdd:
;let's do it automodifying the code of opXor
mov byte ptr [xorit],bh ;bh is always 0, 0 is the opcode for add :)
call opXor
mov byte ptr [xorit],30h ;restore the value of the xor opcode = 30h
ret
opInp:
mov cl,ah ;get dest
shr eax,16
mov bl,al
push bx ;saves ptr to maxcnt
mov al,[bx+di] ;get max counter
mov maxcnt,al
mov dx,offset maxcnt ;weīll read bytes with int 21h
push ax
mov ah,0ah
int 21h
pop ax
mov bl,cl ;restore dest
mov cl,cnt
mov si,offset buffer
copy:
mov al,[si] ;copy bytes from the x86 memory to memoCPU
mov [bx+di],al
inc si
inc bx
dec cl
jnz copy
pop bx
mov cl,cnt
mov [bx+di],cl ;updates maxcnt
ret
ret
opOut:
mov bl,ah ;nothing interesting here
mov dl,[bx+di]
mov ah,02
int 21h
shr eax,16
ret
opMov:
mov bl,ah ;get orig1
mov bl,[bx+di] ;get pointer to value of orig1
mov cl,[bx+di] ;get value of orig1
shr eax,16
mov bl,al ;get orig2
mov [bx+di],cl ;xor it
ret
opStp:
pop ax ;pop the return address to the main loop
ret
opJnz:
mov bl,ah
shr eax,16
cmp [bx+di],bh ;remember bh is always 0, is orig1=0?
je not0
mov ah,al ;change the nextip
not0:
ret
opcodeTable dw offset opXor,offset opAdd,offset opInp,offset opOut
dw offset opMov,offset opStp,offset opJnz
this is the protection coded in the assembler of the memoCPU:
the algorithm used is:
read password
make hash value of password
if calculated hash=key
nice
else
go_beggar
the hash function is very easy, due to the fact that only one byte is used, the final hash space
is very reduced, only 255 possible values, so, in theory 1 of each 255 strings will collide to the
same value, you could test this yourself and see what i mean.
i used this program to calculate the hash value:
code segment
org 100h
assume cs:code,ds:code
start:
mov si,offset pass
next:
lodsb
xor var1,al ;first xors every letter of password, from the first to the last one
or al,al
jne next
std
dec si
dec si
next2:
lodsb
add var1,al ;second adds every letter with calculated xor, from last to first
or al,al
jne next2
int 20h
db 0
pass db 'password',0
var1 db 0
code ends
end start
the protection coded in the assembler language of the memoCPU
look carefully in the the data zone for an explanation of all the strange numbers
buc1: 0 repeat
_inp 162,146,32 ;get 8max bytes pass
_mov 158,157,36 ;saves maxcnt
buc2:
_mov 148,142,40 ;getchar from pass
_xor 142,149,44 ;xor var2 with var1
_add 144,146,48 ;dec length pass
_add 145,148,52 ;inc ptr
_jnz 146, 36,56 ;if length<>0 repeat
_add 144,148,60 ;dec ptr
_add 144,157,64 ;dec maxcnt2
_mov 148,142,68 ;get last char from pass
_add 142,149,72 ;var2+=last char from pass
_jnz 157, 56,76
_add 150,149,80 ;add -result to var2
_jnz 149, 96,84
yes:
_mov 160,151,88 ;ptr to st2=ptr to st3
_mov 159,154,92 ;key3=key2
_mov 161,152,96 ;length bad=length ok
no:
_mov 151,142,100 ;getchar
_xor 154,142,104 ;xorit with key
_add 145,154,108 ;inc key3
_out 142 ,112 ;print
_add 144,152,116 ;dec length
_add 145,151,120 ;inc ptr
_jnz 152,96 ,124 ;if length<>0 repeat
_stp
; data zone, begins at 140 decimal
dat db lst1 ;140=length of st1
db (offset st1-offset dat)+140 ;141=ptr to st1
db 00 ;142=var1
db 'r' ;143=key1
db 0ffh ;144=-1
db 1 ;145=1
mxc db 8 ;146=8
db 143 ;147=143
db 162 ;148=ptr to pass
db 0 ;149=0 ;var2
db -0f0h ;150=-result
db (offset st2-offset dat)+140 ;151=ptr to st2
db lst2 ;152=length of st2
db 'u' ;153=key2
db 'v' ;154=key3
db lst3 ;155=length of st3
db (offset st3-offset dat)+140 ;156=ptr to st3
db 00 ;157=maxcnt2
db (offset mxc-offset dat)+140 ;158=ptr to maxcnt
db 153 ;159=ptr to key2
db 156 ;160=ptr to ptr to st2
db 155 ;161=ptr to length st3
pas db 19,87,83,71,15,23,84,27,89,58 ;162=pass (initializated with garbage)
db 'apocalypse' ; rest of pass, hehehe
st1 db 0ah xor 'r' ;st1 xor key1
okey man, get the point?, hehe
finally the complete listing in assembler, to compile it do a tasm memocpu.asm /m4, tlink /t memocpu
enjoy it!!!
;-------------------------------------------------------------------------
;-------------------------------------------------------------------------
; project name: memoCPU
; coder: anormal/kindergarten
; notes: just another CPU emulator designed with protection in mind
;
; ver: 0.001 : Mon 04-06-1998 : initial
; ver: 0.002 : Tue 04-07-1998 : +opcodes & macros
; ver: 0.003 : Wed 04-08-1998 : +emulated code
; +start debugging, tons (really) of fixes :)
; +and finished :)
; *1st working version
; time: 0.001 : 1:15
; time: 0.002 : 0:50
; time: 0.003 : 2:10
;
;
;-------------------------------------------------------------------------
;-------------------------------------------------------------------------
code segment
org 100h
assume cs:code,ds:code
; opcodes macros
_xor macro orig1,orig2,next_ip
db 0,orig1,orig2,next_ip
endm
_add macro orig1,orig2,next_ip
db 2,orig1,orig2,next_ip
endm
_inp macro dest,cnt,next_ip
db 4,dest,cnt,next_ip
endm
_out macro orig1,next_ip
db 6,orig1,0,next_ip
endm
_mov macro orig1,dest,next_ip
db 8,orig1,dest,next_ip
endm
_stp macro
dd 0000000ah
endm
_jnz macro orig1,ip1,ip2
db 0ch,orig1,ip1,ip2
endm
;--------------------------------------------------------------------------
start:
.386
sub eax,eax
sub cx,cx
sub dx,dx
mov si,offset memory
mov di,si
sub bx,bx
nextCycle:
mov eax,[si] ;get opcode from next_ip
mov bl,al
call [bx+offset opcodeTable]
shr eax,8 ;the next_ip is in the 1st byte of eax
mov si,ax ;si=next_ip
add si,di ;+initial offset
jmp nextCycle
;emulation procedures ----------------------------------------------------
opXor:
mov bl,ah ;get orig1
mov cl,[bx+di] ;get value of orig1
shr eax,16
mov bl,al ;get orig2
xorit:
xor [bx+di],cl ;xor it
ret
opAdd:
;let's do it automodifying the code of opXor
mov byte ptr [xorit],bh ;bh is always 0, 0 is the opcode for add :)
call opXor
mov byte ptr [xorit],30h ;restore the value of the xor opcode = 30
ret
opInp:
mov cl,ah ;get dest
shr eax,16
mov bl,al
push bx ;saves ptr to maxcnt
mov al,[bx+di] ;get max counter
mov maxcnt,al
mov dx,offset maxcnt
push ax
mov ah,0ah
int 21h
pop ax
mov bl,cl ;restore dest
mov cl,cnt
mov si,offset buffer
copy:
mov al,[si]
mov [bx+di],al
inc si
inc bx
dec cl
jnz copy
pop bx
mov cl,cnt
mov [bx+di],cl ;updates maxcnt
ret
ret
opOut:
mov bl,ah
mov dl,[bx+di]
mov ah,02
int 21h
shr eax,16
ret
opMov:
mov bl,ah ;get orig1
mov bl,[bx+di] ;get pointer to value of orig1
mov cl,[bx+di] ;get value of orig1
shr eax,16
mov bl,al ;get orig2
mov [bx+di],cl ;xor it
ret
opStp:
pop ax ;pop the return address to the main loop
ret
opJnz:
mov bl,ah
shr eax,16
cmp [bx+di],bh ;remember bh is always 0
je not0
mov ah,al ;change the nextip
not0:
ret
opcodeTable dw offset opXor,offset opAdd,offset opInp,offset opOut
dw offset opMov,offset opStp,offset opJnz
;begin of emulated code --------------------------------------------------
memory:
buc1:
_mov 141,142,4 ;getchar from string
_xor 143,142,8 ;xorit with key
_add 145,143,12 ;inc key1
_out 142 ,16 ;print
_add 144,140,20 ;dec length
_add 145,141,24 ;inc ptr
_jnz 140,0,28 ;if length<>0 repeat
_inp 162,146,32 ;get 8max bytes pass
_mov 158,157,36 ;saves maxcnt
buc2:
_mov 148,142,40 ;getchar from pass
_xor 142,149,44 ;xor var2 with var1
_add 144,146,48 ;dec length pass
_add 145,148,52 ;inc ptr
_jnz 146, 36,56 ;if length<>0 repeat
_add 144,148,60 ;dec ptr
_add 144,157,64 ;dec maxcnt2
_mov 148,142,68 ;get last char from pass
_add 142,149,72 ;var2+=last char from pass
_jnz 157, 56,76
_add 150,149,80 ;add -result to var2
_jnz 149, 96,84
yes:
_mov 160,151,88 ;ptr to st2=ptr to st3
_mov 159,154,92 ;key3=key2
_mov 161,152,96 ;length bad=length ok
no:
_mov 151,142,100 ;getchar
_xor 154,142,104 ;xorit with key
_add 145,154,108 ;inc key3
_out 142 ,112 ;print
_add 144,152,116 ;dec length
_add 145,151,120 ;inc ptr
_jnz 152,96 ,124 ;if length<>0 repeat
_stp
filler db 140-(offset filler - offset memory) dup (0)
; begins at 140 decimal
dat db lst1 ;140=length of st1
db (offset st1-offset dat)+140 ;141=ptr to st1
db 00 ;142=var1
db 'r' ;143=key1
db 0ffh ;144=-1
db 1 ;145=1
mxc db 8 ;146=8
db 143 ;147=143
db 162 ;148=ptr to pass
db 0 ;149=0 ;var2
db -0f0h ;150=-result
db (offset st2-offset dat)+140 ;151=ptr to st2
db lst2 ;152=length of st2
db 'u' ;153=key2
db 'v' ;154=key3
db lst3 ;155=length of st3
db (offset st3-offset dat)+140 ;156=ptr to st3
db 00 ;157=maxcnt2
db (offset mxc-offset dat)+140 ;158=ptr to maxcnt
db 153 ;159=ptr to key2
db 156 ;160=ptr to ptr to st2
db 155 ;161=ptr to length st3
pas db 19,87,83,71,15,23,84,27,89,58 ;162=pass (initializated with garbage)
db 'apocalypse' ; rest of pass, hehehe
st1 db 0ah xor 'r' ;st1[1] xor key1
db 0dh xor ('r'+01) ;st1[2] xor key1+1, etc...
db 'm' xor ('r'+02)
db 'e' xor ('r'+03)
db 'm' xor ('r'+04)
db 'o' xor ('r'+05)
db 'C' xor ('r'+06)
db 'P' xor ('r'+07)
db 'U' xor ('r'+08)
db ' ' xor ('r'+09)
db 'b' xor ('r'+10)
db 'y' xor ('r'+11)
db ' ' xor ('r'+12)
db 'a' xor ('r'+13)
db 'n' xor ('r'+14)
db 'o' xor ('r'+15)
db 'r' xor ('r'+16)
db 'm' xor ('r'+17)
db 'a' xor ('r'+18)
db 'l' xor ('r'+19)
db '/' xor ('r'+20)
db 'k' xor ('r'+21)
db 'i' xor ('r'+22)
db 'n' xor ('r'+23)
db 'd' xor ('r'+24)
db 'e' xor ('r'+25)
db 'r' xor ('r'+26)
db 'g' xor ('r'+27)
db 'a' xor ('r'+28)
db 'r' xor ('r'+29)
db 't' xor ('r'+30)
db 'e' xor ('r'+31)
db 'n' xor ('r'+32)
db 0ah xor ('r'+33)
db 0dh xor ('r'+34)
db 'E' xor ('r'+35)
db 'n' xor ('r'+36)
db 't' xor ('r'+37)
db 'e' xor ('r'+38)
db 'r' xor ('r'+39)
db ' ' xor ('r'+40)
db 'p' xor ('r'+41)
db 'a' xor ('r'+42)
db 's' xor ('r'+43)
db 's' xor ('r'+44)
db 'w' xor ('r'+45)
db 'o' xor ('r'+46)
db 'r' xor ('r'+47)
db 'd' xor ('r'+48)
db ':' xor ('r'+49)
db ' ' xor ('r'+50)
lst1 = $-offset st1
st2 db 0ah xor 'v' ;1xx=st2 xor key3
db 0dh xor ('v'+01)
db 'B' xor ('v'+02)
db 'a' xor ('v'+03)
db 'd' xor ('v'+04)
db '!' xor ('v'+05)
db '!' xor ('v'+06)
lst2 = $-offset st2
st3 db 0ah xor ('u') ;1xx=st2 xor key2
db 0dh xor ('u'+01)
db 'G' xor ('u'+02)
db 'o' xor ('u'+03)
db 'o' xor ('u'+04)
db 'd' xor ('u'+05)
db '!' xor ('u'+06)
db '!' xor ('u'+07)
lst3 = $-offset st3
;end of emulated code ----------------------------------------------------
maxcnt db 12 ;this 12 donīt means nothing is just some trash
cnt db 82 ;more trash
buffer db 'heavensfacility' ;more trash, hehehe, nice for lamers
code ends
end start
4. closing words: greetings, stupid things, etc...
Some final words:
I only expect that some of this notes could serve to anyone :).
First of all i want to give thanks to solar_designer, for giving me hi file hackme.com (the one and only intelligent, original and portable crackme!!). This is the best "clever" protection scheme iīve seen in many time. This file,hackme.com, is a TRUE hardwork, a cpu emulated with NOR gates.
Hey solar!!: wherever you are, thanks!.
Second, i want to give thanks to fravia for maintaining so astounding site, he has done of the HCU project a reality.
I also want to greets to lord_byte for the initial testx series, the guys at #cracking, #ucf200, #pc, #revolt. Even when 80% all them are just a bunch of arrogant inmature kids... :)
ejemm... enough greets...
If you have better ideas than myself (this is very easy), then write an essay and send it to fravia, @:]
Finally, a stupid poem:
Soul nopper
NOPS in the middle of your code,
suddenly a 75h becomes a EBh,
INTs 1, 0CChs, SMIs in my screen,
all i can afford, all i can forget,
the ctrl+d firing the ice in the bus...
the F12 PRETing until the end of the world ...
the BMSG shouting your voices...
and the only thing i can't crack...
the scent you left behind,
it's so long to XT, so long to BPM R,
IF i BPIO 378h THEN you will hang.
so,
my dreams and your smile,
my screen and your traps,
dust in the wind, clouds in the sky.
(booarrrgg: you can vomit now :)
You can reach me at anormal1@yahoo.com
© all rights reserved anormal/kindergarten, 1998.
Release to the public domain for free use and abuse to all cracking community, you could not use portions, or full algorithms of this page for commercial applications without written permission. Microsoft could buy a license to use this schemes in its products after paying to me, the author, a license of $1,000,000. Hey billy, thanks for all the blue screens.