Reverse engineering Academy
Project 1
~
Hexeditors reverse engineering
(and other tools of the trade)
Binary editors
Binary editors are usually refered to as a hexeditors. The main
difference between a regular texteditor and a hexeditor is that a texteditor
translates some bytes to tabs, linefeeds, carriage returns, etc or simply
ignores them. A hexeditor does no such thing, instead it prints the
hexadecimal value of the byte. Most hexeditors have a textfield as well, where
you'll see all sorts of funny-looking faces and arrows.
We have decided to include in this project also all other essays related to important
"tools of the trade", like IDA: Interactive disassembler, the most powerful
disassembler around now (with its version 3.7).
IDA is an 'official +HCU tool' 1997!
Official +HCU tool
A very important project... hexeditors are the swiss knifes that we continuously
use... +ORC seems to prefer good old psedit, and even
if we still use it a lot, we use more and more hexworkshop,
(cannot be wrong: version 2.1 has been cracked by +ORC himself in his lesson 9.3...
as he explained the "dead listing" approach).
The +HCU has received various essays about hexeditors reverse engineering, and about other
important tools for our trade... here are
the best ones, stay tuned for more!
Project started 17 August 1997
PHASE 1 by Heres:
How to register HexWorkshop v2.52 (32bit),
03 June 1997
(the HEXWORKS.REG trick) - (heres1.htm: FVP01F01)
PHASE 2 by Aesculapius:
Hex Workshop 32 v. 2.53, 05 July
1997
(A weak protection scheme is worst than no protection scheme at all) -
(aescul3.htm: FVP01F02)
PHASE 3 by +daQ:
Hexpert32, Version 3.0.05, 06 August 1997
(Cracking the tools of the trade) - (daqtod.htm: FVP01F03)
PHASE 4 by x86:
Cracking HEdit 2.0, 19 August 1997
(using wdasm as a debugger) - (x861.htm: FVP01F04)
With an addition! 20 August 1997!
With an addition by itzMagik1, 4 January 1998
Cracking HEdit version 2.1.11
PHASE 5 by Aesculapius:
ULTRAEDIT-32 V. 4.40a, 21 August 1997
(Slight Variations of the Serial Number-based protection scheme) -
(ueditcrk.htm: FVP01F05)
PHASE 6 by ReZiDeNt:
Reverse Engineering UltraEdit-32 4.40a, 22 August 1997
(Cracking "blacklisted" Hex/Text Editors) -
(reziedi1.htm: FVP01F06)
Well two authors reverse engineering the same protection scheme on the same
target at a day distance! Quite interesting isn't it? Read what Rezident and
Aesculapius wrote
each other here!
PHASE 7 by Quine:
Cracking THE tool of the trade (bye bye Wdasm), 19 October 1997
(Interactive Disassembler Pro v3.7) -
(quine1.htm: FVP01F07)
Advanced cracking series
Well, this is SERIOUS ADVANCED CRACKING. You better read and UNDERSTAND each point of this
beautiful essay by Quine, which shines methodologically and has a relevance that encompasses
almost all fields of our trade. There are things inside here, like patching pointers and
Boundchecker API-intercepting,
wich clearly are NOT FOR NEWBYES, and the whole essay is GOLD worth
for all serious reverse engineers. This essay has been added to the +HCU didactic material
(pending Quine's authorization) and will from now on be distributed to all
+HCUkers that begin the courses together with the other main files
PHASE 8 by Frog's Print:
SOURCER 7, 29 October 1997
(efficiency of a well
positioned BPINT under DOS) -
(sourcer7.htm: FVP01F08)
Advanced cracking series
Well, back to DOS! Was about time! Contrarly to what some
still choose to
believe, dos reversing is far from being an obsolete activity: many very important
programs are working under DOS, because Windoze simply does not give enough
power, and as +ORC told us long ago in his tut, many of the older DOS protections
are much more tougher and interesting than the banal cmp eax, 1 tricks inside
"compiled" windoze targets...
There is another very nice lesson teached here by Frog's Pint: let's not
be lazy! Almost anyone uses a "ready cracked" (read "stolen") Sourcer 7 version which comes with
a pirated serial number inside it: the
whole Web is polluted with all pirated versions of this important tool, and
noone seems to care about the only thing that is really
fascinating in our opinion: how to reverse this reverser program
'par excellence'. And Frog's Print does exactly this, and he writes:
As we are crackers, let's throw away this serial number and
crack Sourcer 7.0
Right! And if you add to
these 'strategic' thoughts the whole cursor bpinting, you'll agree with me that this
essay deserves to be posistioned among the prestigious
"Advanced cracking series". Enjoy!
PHASE 9 by Quine:
Interactive Disassembler Pro v3.7 Demo (II), 30 October 1997
(How to load the previous databases) -
(quine_21.htm: FVP01F09)
Advanced cracking series
Well, this is SERIOUS ADVANCED CRACKING once more. Once more a fundamental tool of the
trade (IDA). Once more a function reenabling work (the loading of the previous databases, i.e.
one of the most important crippled functions of the crippled version: you do not want to
start everything anew every time you use IDA, do you?). Once more something
we all need: new knowledge that you can at once apply to other targets and reverse
engineering endeavours.
Quine is getting us used to
this kind of well-crafted essays. I'm afraid newbyes will not understand much here,
please read the 'basic' essays first, and peruse the other
+HCU page (where you'll find a lot of help for newbyes) before delving in this.
This said, here you have a real reverse engineering essay in all its glory... enjoy!
PHASE A by Aesculapius:
ULTRAEDIT 5.00 S/N Generator, 24 November 1997
(a very funny dynamic addressing process as copy procedure) -
(aescune1.htm: FVP01F0A)
This good tool is everywhere to have, regged, for free. I think therefore that
Aesculapius work, far from damaging him, can actually be USEFUL to Ultraedit's Author Ian Mead... here is the point he
should take care of:however, the program still has to read the registration file to
gather its initiation values, so a bpx on readfile should be enough to find
a fairly close entry point to it
Learn here
from Aesculapius how this protection scheme works. It's interesting and the keygenerator in asm at the
bottom can easily be modified for other targets. If you crack Ultraedit register it
after 45 days, it deserves it (IMHO). Enjoy!
PHASE B by Little-John:
winrar 95 ver.2.0: the guts of a simple protection, 04 January 1998
(why keygenerating when you can patch them on the fly?) -
(littlejo2.htm: FVP01F0B)
Well, an interesting little essay which deals with an utility by Eugene
Roshal that is in my opinion injustely underestimated. Winrar should by all
means be on your desktop: it has, on mine, taken the place of my
Winzip 6.2 (it deals without problems with all zipped files as well),
and that for many reasons, the more important one is that RARed archives are
SMALLER than pkzipped archives!
No, I'm not speaking of the solid archive
option (you don't know what 'solid' archiving is? Go and study winrar), I'm
speaking of a normal, default rar archive: it's smaller than a zip!
I know that many don't even know it, and I
myself am still compelled to use the zip format when I dump something on
the web 'because everybody zips'. Yet I myself, for myself, on my own harddisks,
use only RAR, because with the monstruous overbloated programs we are
dealing with 'every spared byte counts'... and you'll spare a lot of bytes
in comparison with zipped files if you rar. You still don't believe me? Well,
read, enjoy and then go and download winrar... you'll be surprised seeing
how GOOD this tool is.!
The essays of +HCU's project 1 will continue after
Quine's explanations about IDA.
Some explanations on IDA, by Quine, 6 November 1997
Dear fravia+,
I'm very pleased to see people using IDA. I really, you know,
think of it as a dear friend now (I know this sounds sick :-). Just
thought I'd clear up a few points from Snatch's and zeezee's essays.
From Snatch's essay:
The 'aThelab' that Snatch finds is the name of a location in the
data section, a location that contains the ASCII string "The lab....".
Just double click on 'aThelab' and you'll jump right there. I was a
little confused by your reference to Smartcheck regarding this.
Anyway, IDA names every location that it can in the data section (and
everywhere else for that matter) and it uses the 'a'+beginning of
string for ASCII strings. Admittedly, it does not have that nice
dialog box that w32dasm has that lists all the strings (or are they
ALL the strings in w32dasm? No! Just the ones directly referenced in
the code), but zeezee's Alt-B searches work just fine.
From zeezee's essay:
Zeezee has obviously spent some time with IDA and all of his tips
are quite sound. Just as a matter of style, I prefer to keep the
crossrefernces at about 10 -- you can always use
View-->Crossreferences to see the rest. This keeps screen clutter
down. IDA's 'automagically' finding the names is of course its
library recognition function (one of its MOST powerful features).
Keep in mind that there may be more names to be found than what it
automatically does. Often, at the beginning of the status window it
recommends optional libraries to check for. Most commonly if yuo have
a M$ compiled file, it is poosible that it uses MFC linked statically
(ie, not in a dll). IDA cannot always be sure of this, so try
applying the MFC library recognition (View-->Signatures). You'll be
amazed at the wealth of information.
Regarding IDA's weaknesses, yes the help is a little cumbersome,
but as zeezee says, it is all there. The resource problem is a
problem, but only temporarily. Look at the file resource.idc in the
idc directory (in fact, look at and study everything in that
directory). It is a file for sorting out resources in NE files (a
remnant of the horrible days of Win16-- among other things the ugliest
OS ever). What needs to be done is someone needs to write a really
idc script/macro/program to sort out PE resources. I have plans to do
this, but who knows when that will happen. In general, people need to
study the idc language. Its power is amazing given that it's solely
done for IDA.
Oh, one last thing. Go through the ida.cfg file and above all
else, change the window size. Until I figured out how to do this, I
found IDA impossible to use. Make it big. I have mine set at 132x64.
Anyway, you need a big space to work in.
Hope this helps.
Quine
PHASE C by +Alt-F4:
Cracking Wingdis 2.12, 11 January 1998
(Preparing ourselves for 'real' Java cracking) -
(altF4j_a.htm: FVP01F0C)
Well, Alt-F4 is an incredibly interesting +cracker that works a lot with
Java, he's
the Author of a FONDAMENTAL essay for all java
reversers: Cracking (black and blue)
Java Workshop 2.0, a program that you should by all means study and use ~ alternatively, you may
have found on some CD-ROM for free Symantec Visual café trial version 1.0,
and you could in that case enjoy A+heist's essay
a very silly protection scheme on a very interesting target
Therefore it suits us all A LOT that +ALT-F4 shows here the
(incredibly simple) way to reverse the main Java disassembler: Wingdis.
In fact, after the sad demise of the clever Author of
the mocha disassembler (hope he'll enjoy some reversing possibilities
wherever he did
land after having left us :-) Wingdis will be one of the
main tools we all will have to use in the next months That said, we'll
use Wingdis until
our own
+HCU '98 tools will be ready -at the moment they seem still "under
development" :-( Anyway all these java essays are GOOD NEWS! Java is
coming! Die Gates die in flames, you horrible slimy bloated bane! Die die die with
all your useless overbloated applications! :-) So I'm happy
to host another fine "Java" +HCU essay, coming to you from mighty
+ALT-F4 pen (and brain). Enjoy!
Hey buds! Feel free to reverse engineer whatever
hexeditor or tool of the trade you can put your hands on, even if it
uses very stupid protection schemes!
(This is the only project where we'll in fact accept essays about
stupid and boring protection schemes... yet, please, try at least to
find some other interesting "finding" inside the code of these targets
if the protection scheme is too stupid and too boring, else even a good
tool wont be interesting for anyone :-)
homepage
links
anonymity
+ORC
students' essays
academy database
tools
counter measures
cocktails
antismut
search_forms
mail_fravia+
Is reverse engineering legal?
(c)
Fravia 1995, 1996, 1997, 1998. All rights reversed
|