Sender: pepper_32@hotmail.com
Received: from galaxy.chez.com ([194.98.133.161] (may be forged))
	by arl-img-5.compuserve.com (8.8.6/8.8.6/2.9) with ESMTP id NAA19596
	for <100114.453@compuserve.com>; Sun, 16 Nov 1997 13:33:07 -0500 (EST)
Received: from hotmail.com (F78.hotmail.com [207.82.250.184])
	by galaxy.chez.com (8.8.5/8.8.5) with SMTP id TAA08730
	for <MSRE@chez.com>; Sun, 16 Nov 1997 19:31:47 +0100 (CET)
Received: (qmail 4274 invoked by uid 0); 16 Nov 1997 18:32:11 -0000
Message-ID: <19971116183211.4273.qmail@hotmail.com>
Received: from 194.231.124.37 by www.hotmail.com with HTTP;
	Sun, 16 Nov 1997 10:32:10 PST
X-Originating-IP: [194.231.124.37]
From: "pepper" <PEPPER_32@hotmail.com>
To: msre@chez.com
Subject: script 1 of 2
Content-Type: text/plain
Date: Sun, 16 Nov 1997 10:32:10 PST

Hi whoever is there: FRAVIA is the greates page I ever found
on the WEB. Helped me a lot and guess its time to say not only
thank you but also to send some small "note". Have followed
your instructions HOW and WHAT to send. Hope it will be
interesting for more than only me.

Pepper [PC] - "Script follows after next line"
==============================================================

O'Basic - a real joke if used for Shareware Registration !

I found a nice tool from a German author: SysSave 3.2 which
protects against crashes of the Win 95 Registry. Really fine.
But more fascinating was the protection I never saw before.
As usual asking for a name and a RegCode looked simple. Lets
run WinIce and have a look using typical BPX like GetWindowTextA.

The code we find looks crazy, like a Visual Basic program. But
it is not VB. It is a kind of a script language called O'BASIC.
And really we find OBENGINE.DLL which obviously does something
similar as the well known DLLs for VB.

Do we need a Decompiler and where to get from ? No, because
O'BASIC works a bit different to VB. To shorten the story:
set your BPX to enter somewhere in the code and then make a
dump of the memory. Scroll up and down in a wide range and
very soon you will see something in the Memory Window (NOT in
the Code Window) which looks like clear Basic Source Code.

Obviously the source code is saved in tokens like in VB cause
the EXE-File does not show readable instructions. But during
runtime the source is extracted before executed by OBENGINE.DLL
So I call it a "Script Language".

In the above mentioned sample we find in the memory dump: 

  L# = Len(UserIn$)
  
  For I# =1 to L#
  Name#[I#]=Asc/Mid(UserIn$),I#,1)
  EndFor

  Reg# = 0
  For I# = 1 to L#
  Reg# = Reg# + (Name#[I#]*I#)
  End For

  Reg# = Reg# + (SqRoot(Reg#)*SqRoot(Reg#))
  Reg$ = Oct(Reg#)

So simple like any Basic. UserIn$ seems to be the Name entered
and Reg$ to be the RegCode. Lets try "Pepper" as Name and calculate
the RegCode: 10636 - Bingo! A KeyGen now takes a few minutes.

So what we learn is: if we have some unknown language using a
DLL it's worth to make a memory dump during runtime...
BtW: looking for the KeyGen ? Its out there as PC_SS32.ZIP
     
by Pepper [PC]                                    November 97



______________________________________________________
Get Your Private, Free Email at http://www.hotmail.com