Reverse engineering Academy
Taxonomy
~

Snippets

Various "snippets" about (more or less) useful tools
and
rare snippets from some +HCU seminars

---

A fairly important project, started on 28 October 1997.
Last updated: End July 1998
The "snippets" you'll find here have been published 'rough'

1)	They may be almost uncommented (advanced users do not need comments)
2)	They may be fairly irrelevant for techniques used or analyse depth, yet
        regard targets that may be useful for our trade
3)	They are not edited

 CLICKBOOK - Stupid Protection / Tools of the trade By VisualBB

I also had the opportunity to get a program that is useful for us -
CLICKBOOK from forefront the makers of Quick view pro that Essential
utility. It condenses printouts into booklet form.

This program "DEMO" can be got at:

http://www.ffg.com/wp/clickbook.html

It prints booklets that are a great paper saver. Only thing is the
damn demo prints a box on every page with the words "TRIAL VERSION" as
well as the site address - "www.ffg.com". This was too irritating for
words and so I ran it thru WDASM looking for the words Trial Version
which were found scattered all over.

While examining the code I noticed that every time a shareware notice
as present there was also a normal notice. This seemed to be too easy.
Also the program checked location 00401E6E and if 0 jumped to good and
anything else was bad and demo.

So I searched for this location to see where the flag was being set. I
found it being set at 3 locations. 

Set breakpoints and start the debugger of wdasm32 ( which I find
easier to follow than SICE though not as powerful. We break at the
first breakpoint I set which was a call to a function that returned 1
in EAX which was loaded into our 00401E6E and then CMPared . So I
changed the 1 to 0 in ax and ran. No initial nagscreen but still the
box was present. Obviously the value was being changed elsewhere.

Load the program again this time trace into the call. and after
stepping a lot and after a check to some value in the registry, we
arrive at this code:

:004346E5 7518                    jne 004346FF
:004346E7 3BC8                    cmp ecx, eax
:004346E9 7514                    jne 004346FF
:004346EB 83F906                  cmp ecx, 00000006
:004346EE 750F                    jne 004346FF

* Possible Reference to String Resource ID=00001: "Pass B"
                                  |
:004346F0 B801000000              mov eax, 00000001 
Websnake version 1.22 (fetch a whole site on da web) by A+heist
Find it on da web... you are supposed to be a master searcher :)
    
Hi frav, 
Here they protz a little, yet read and you'll understand why I 
wanted to try it out, and why you'll want to try it out and 
why everyone will want to try it out:
Download a website for off-line browsing, which means you can 
view the entire site on your own computer much faster than if 
you were on-line.  And, you save money on dial-up costs, too!
Duplicate or mirror a website, including the directory structure.  
Great for webmasters and web designers to see how a website 
is setup.
Copy e-mail addresses referenced in a website’s HTML files. 
These e-mail addresses can later be exported into a comma or 
tab delimited database file.  The applications of this range 
from simple research to broadcast e-mail marketing.
Build a map of the HTML files referenced in a website.  
Need to know the structure of a remote website?  This is 
your tool.
Search for specific keywords on a website.  Get the information 
you need in a flash.
Retrieve specific types of files like all the cool graphics, 
sounds (WAV files), or movies (AVI files).  WebSnake automatically 
downloads anything you want quickly and easily.

Here we go:

:10007352 E8F9020000              call 10007650
:10007357 833D1861011000          cmp dword ptr [10016118], 00000000
:1000735E 740E                    je 1000736E   ;nop this bad one
:10007360 833D1461011000          cmp dword ptr [10016114], 00000000
:10007367 7505                    jne 1000736E  ;nop this bad one
:10007369 B81A750000              mov eax, 0000751A     ****! GETTAGODDAFLAG

:Check_luser_status
:1000736E 3DEE550000              cmp eax, 000055EE
:10007373 7464                    je 100073D9         
:10007375 3DCB590000              cmp eax, 000059CB
:1000737A 745D                    je 100073D9         
:1000737C 3D1A750000              cmp eax, 0000751A   ;is he registered?
:10007381 0F84B2000000            je 10007439         ;yes, go go go good guy

:Check_luser_really_registered
:10007439 833D1861011000          cmp dword ptr [10016118], 00000000
:10007440 7413                    je 10007455   ;ok, good guy
:10007442 833D1461011000          cmp dword ptr [10016114], 00000000
:10007449 750A                    jne 10007455  ;ok, good guy
:1000744B 83C634                  add esi, 00000034
:1000744E 684F750000              push 0000754F  ;"Retail Version"
...
:OK_good_guy
:10007455 83C634                  add esi, 00000034
:10007458 684A750000              push 0000754A ;"Your software is registered. Thank you."
  
Well that's it, I'm afraid: stupid, much too stupid scheme.  
May be the target could be useful: dunno, never tried it yet, 
don't have the time to surf much with my fukin Uni and all the 
fukin essays you keep publishing and I have to read to keep abreast :)     

A+heist

                PROTEXE V2.11 - TOM TROFS
             EXPLORING THE PROTECTION SCEHME
                          BY
                 THE UNDERTAKER -=BANDA=-


After a long period of busy shedule. Finally I managed to start my reverse
engineering essays. Today we will explore a another EXE protector called
PROTEXE. Exploring the EXE protectors you will learn a lot. Because normally
they use good encription & anti debugging tricks. Most of the time they use
Vector replacement, Self modifying code, Anti debugging tricks. Some of them
uses very good protection schemes. Truly hard to crack those. Ok lets get
back to work. First, protect a EXE file using PROTEXE. Now set up our
favorite tool soft-ice 2.80 for DOS (Yes: dos cracking is great fun!).

Load your protected EXE file using Symbolic Loader (LDR).

LDR lha.exe have to think twice
It is true this is a dammn "windows" age, I'm afraid. 
Yet there are still quite a lot of good reverse engineers in 
this Micro$oft 'tamed' world :-)

Ok, now for the most stupid readers, Using a hex editor you can change few opcodes in 
this
program. Find those opcodes and change. Then use TRON to unpack it. 
Shhhhh!
If you have any problems contact me...


I would like to read your comments. 
You can write to me on following email address..

                undertakerd@hotmail.com



NOTE - If you compressed the program before running protexe. Then above
       OFFSET address can be changed. Also you can down load the PROTEXE
       program in FRAVIA's PAGE.




Thanks goes to all HCU+ & ORC+ guys.
Next time we move to a differnt type of a protector. Until then 

                         REST IN PEACE

                The Undertaker -=BANDA=- //SRI LANKA//

Cracking Norton Antivirus Trial Edition
By ThunderLord
At first lets take a look at the directory where all the files were installed. It containes several executables. Four of them are the files which run the main virus scanner, resident virus scanner, sheduler and a rescue disk creation utility.
The first strange thing is that those files are all exactly the same size, about 160 kb. That seemed quite strange for those completly different executables, but my first thought was, that they were wrapped against viral protection.
The protection consisted of a nag screen with amount of trial days left, which appeared at the startup and asked to press the "still on trial" button. There was a possibility to register the package on-line using the internet or modem, but no place wher! e to enter the serial number. That's probably because Symantec decided not to provide telephone lines for direct ordering.
One of the first funny ideas which popped in my head was to hack the winsock.dll to provide a fake registration, but then I declined the idea as beeing too complicated :)

So lets begin with the first step:
I launched the WDASM and quickly produced a dead listing of the main scanner executable NAVW32. At the same time I extracted the resources from it using Borland C++ 5.0 and took a long look at all dialog boxes, remembering their id's.

One little sidestep: sometimes I prefer to use Micro$oft Developer Studio, because Borland's Tool tends to crush when processing the menus:( Using Bill's tool I always get a strange warning messagebox, saying: "You may be anable to save the resources! back to file, because you are probably using a version of operation system which does not support editing the resourses in the executables". AHA ! Well, Borland's editor doesn't seem to have this problem, Bill !. You are trying to scare me off from editing! the Micro$ofts own programs. Well, lets get back to our NAVW32...

Trying to look at the resourses in other files and after reading a number of colorfull dialogs, I found out that Symantec is not using their own protection sheme, but some company which provides online registering service of different software. They eve! n have a whole DLL containg a so called "Sales Agent". Strange thing that I found some references to Micro$oft Front Page in those dialogs, that probably means, that Micro$oft are also using that "Sales Agent".

After finding the id of the dialog which popped up at the startup I quickly searched for it in the dead list. The following code was interesting:

:004024B2 cmp dword ptr [0042173C], 00000000
:004024B9 jne 0040260D ...
:004024C6 cmp dword ptr [004200BC], 00000000
:004024CD push 004027B0
:004024D2 push eax
:004024D3 je 004024D9
...
Set up a dialog for some other product and jump to 004024E2
...
:004024D9 push 00000067 :004024DB mov ecx, dword ptr [0041D344]
:004024E1 push ecx
:004024E2 Call USER32.DialogBoxParamA
...
MANY different dialog boxes
...

Well as you can see the our dialog box is lying in the chain of other dialog boxes for some other nagscreens and stuff... But the first thing which poppes up is the cmp instruction at the first line. It looks very suspicious as it jumps over the bunch o! f the nagscreens, and the location in memory looks very much like a flag !
I tryed Softicing it and found out, that memory location is only touched once befor this compare... it is zeroed somewhere in the startup code ! So there is a quick crack:

:004024B2 mov dword ptr [0042173C], 00000001 :004024B9 jmp 0040260D
The move is nessesary, cause there can be more places where the flag is checked, but this place is the First.
The main scanner is done... no more nagging. Other four executables are cracked similary, they are compiled exactly as this, even with the same opcodes at the same addreses. This comfirmes that the files were processed by Sales Agent wrapper.

Suddenly after a few days of using the software I adjusted my system clock and a window from the resident scanner popped up saying that I am using a timed software and I may not change the time. I realised that there are some more places where the files! need to be patched.
I set my clock to year 1999, and loaded the NAVW32 in to the SoftIce again and quickly patched it in one more place.
I thought that the crack was done when I suddenly noticed that there were loading two copies of the resident scanner one as an executable another as a dll. That looked like a very "unclean" crack, so I decided to take a very serious look at the whole th! ing again.
In the installation directory I found a few executable files which were called almost the same as the main scanner, resident scanner, and other antivira tools, but they were ending with POP, like NAVW3POP.EXE. Theese files also had a exact size and even! icon. I launched one and got a standart windows animated "file copying" dialog box which terminated in a few seconds and showed an error message saying:
"You can't run this program now, but leave it where it is because the system will need it later". Hey that looks like some kinda selfextracting installation file.

I loaded it in the wdasm peeked at it's code... Some interesting opcodes were found:

...
Animated dialog which shows files beeing copied
...
:00401F30 Call KERNEL32.SleepEx :00401F36 call 00401CF0 :00401F3B cmp eax, FFFFFFFF :00401F3E mov ebx, eax :00401F40 jne 00401F4E
:00401F42 push 00000000 :00401F44 mov esi, USER32.PostQuitMessage
:00401F4A call esi
:00401F4C jmp 00401F54
;DON'T QUIT YET, just "prepare" for quit, cause BX can still hold 0 or 1
:00401F4E mov esi, USER32.PostQuitMessage

:00401F54 test ebx, ebx :00401F56 jne 00401F8F ...
;Quitting with a messagebox containing "You cannot run this application at this time."
...
:00401F71 mov edi, USER32.MessageBoxA
...
:00401F87 call edi
:00401F89 push 00000000
:00401F8B call esi :00401F8D jmp 00401F95
;IMPORTANT JUMP lands here
:00401F8F mov edi, USER32.MessageBoxA :00401F95 cmp ebx, 00000001 :00401F98 jne 0040203C ...
;Cool Guy operations go here (like unpacking the executable)
...
:0040203C xor eax, eax ...
:00402047 ret 0010

As you can see, the code loads EDI and ESI with addresses to PostQuitMessage and MessageBox, threatning to call them if the value in EBX is not equal to 1. Therfor the patch should put a value of 1 in the BX somewhere after the naughty routine call and ! before the great EBX checking starts...
This task can you perform yourself, because when I first cracked it I was tired and therfor patched the previous code in TWO locations...but now I can see a pretty easy to do it in one.
After patching the file is unpacking without any trouble and it replaces the "fake" wrapped Symantec Utilities with a real, clean, and without any nags utilities. The patch is performed on all 4 *POP.EXE files which have the same code at the same adress! es. After the execution of the poppers they may be deleted together with the SalesAgent DLL. You can even patch those poppers in the softice memory and let it run afterwards unpacking the whole thing, the crack only needs to be there on their first run. Tha! t was it, Norton AntiVirus Trial Edition is cracked.

Note at the end: There is a single DOS application included in the Symantec package, which is used under the boot before Windows loads. Because it is a DOS application I didn't take a look at it, as I prefer cracking win stuff, so if there are! somebody who can finish my work they are welcomed to make any additions to this essay.

---

			Winimage Version 2.50
		How to make a MSGBOX work for YOU 
			      by RMD+

There are probably many others like me who are still learning how 
to crack or aren't very good assembly programmers and yet want to 
write Keygenerators or who are too lazy to rip out the code 
in order to write one. 
In this essay I want to show how to turn a target program into a 
Keygenerator by getting the Msgbox that says that your entered 
number is incorrect (or correct) to show you the "secret" password 
instead.

The idea for this came from one of our masters tutorials, 
where +he said about how ECHOs of the proper serial Number 
are left lying about in the data window.

Fire Up Winimage go to the Registering bit and enter your 
name and a fake serial, so in my case RMD+ and 12345.

CTRL+D to SOFTICE 
and 
BPX GETDLGITEMTEXTA

go back to Winimage and press enter

The program should now have immediately broken into 
SICE in the middle of the call, so press F11 to return.

Disable ypur breakpoint by BD 00

Now if you look above this @ 0040579E you see the 
following: 

0040579E MOV ESI,004252D0
004957A3 PUSH ESI

if you d esi you see that you name was copied into ESI 
and then ESI was added onto the stack

now if you F10 past the next GETDLGITEMTEXTA you see 
your serial num get put into EDI.

Keep on F10-ing till you get to 

00405827 call 0040F238 ;Enter this call here 

Our approach here is we know that our ECHO is near to the 
Msgbox text that says "Registering Information are bad". 
So what we've done is enter the call that loads that 
information into memory.

If you F10 down to 

0040F242 LEA EAX,[EBP+FFFFFF14] ;you see the text 
				;string "Reg info bad" 

now, you should of course dump that memory: 
  	 d EBP+FFFFFF14
and if you look around that area you'll see the correct 
registration code at 0067F31C and you'll also see another 
copy at 0067F33C, but for the purpose of this short study 
we'll use the one @ 0067F31C ('cos the other one gets 
written over)

If you carry on single stepping you'll get to 

0040F250 PUSH EAX
0040F251 PUSH DWORD PTR [EBP+0C]
0040F254 CALL 00410D47  ;here is where the string for the Msgbox 
			 caption is loaded which overwrites the 
			 second serial

if you single step to 40F277 and dump memory there, you'll 
see that the MSGBOX text is getting put into ECX and then 
ECX gets put onto the stack.

THIS IS THE IMPORTANT BIT

If you look, you'll see that our serial number is @ 0067F31C 
and that the EDX register is zero. So assemble line 0040F277 
to load the serial number text instead of the Msg text 
by doing the following:

a 0040F277 {PRESS ENTER}
  LEA ECX,[EDX+0067F31C] {PRESS ENTER}

now if you carry on pressing F10 you'll see the correct serial 
number coming up for whatever name you have given as input.

So here is the patch for this:

in you HEX editor load the EXE file and search for 8D8D14FFFFFF then 
replace this info with 8D8A1CF36700, save, and then try it out.

Now every time you want a serial number just enter whatever name 
you fancy and BINGO!

Note that this is not the best clean patch of the world, of course, 
and that also it occasionaly gives garbage for a particolar password. 
It's just pure fun AND a different approach about what you can do 
when the correct Number is ECHO'd in memory.

Anyway I hope somebody finds it useful 

RMD+

---

---

homepage links anonymity +ORC students' essays academy database
tools counter measures cocktails antismut search_forms mail_fravia+
Is reverse engineering legal?

---