191 lines
8.4 KiB
Plaintext
191 lines
8.4 KiB
Plaintext
_CbD_ Tutorial #6
|
|
Modifying dll's to
|
|
give real reg codes
|
|
Target:VoxPhone
|
|
|
|
|
|
Pre Crack notes:
|
|
|
|
Ok how many of you have wanted to crack a program and
|
|
have it give you the real registration code instead of
|
|
the Sorry you entered a invalid Code message? Hmm
|
|
thought so everyone. ok well that is what this tut is
|
|
all about. This will show you one of many ways to do this
|
|
the program we will be werking with uses a dll to check
|
|
our reg number so this will also give you a little info
|
|
on cracking dll's.
|
|
|
|
|
|
About the Tut.
|
|
|
|
Target: Vox Phone
|
|
where to get it: www.voxware.com
|
|
protection type: user ID number / key number
|
|
tools needed: Softice, W32dasm, Heiw (Hexeditor)
|
|
Tut requested by: JosephCo & nIabI
|
|
Crack requested by: DarkNight
|
|
|
|
|
|
Well if you have ever read any of my tut's then you are
|
|
aware of my style of cracking, Step by Step is the
|
|
nest way for newbies to follow IMHO so that is how this
|
|
tut will flow.
|
|
|
|
Pre Crack notes
|
|
You will need to run the program while you are on the net
|
|
then disconect so you can use the BreakPoint we will need
|
|
if you try to do this online you will break every time
|
|
your system gets info from your ISP but the program will
|
|
not start if you are not online so make sure your online
|
|
when you start then log off. Also you will have to click
|
|
on [help] register then fill out the form and tell the
|
|
you are going to send your registration in by mail
|
|
then you will be able to enter a registration number
|
|
after that.
|
|
|
|
Step 1:
|
|
|
|
ok lets start by setting the Break Points we will need in Softice
|
|
the one we will use first is GETDLGITEMTEXTA so set that in si
|
|
(BPX GETDLGITEMTEXTA)then press ctrl-d to return to our
|
|
program. Now lets go back to [help] and register and you
|
|
will see the box asking for a regcode. enter anything you want
|
|
as long as it fills the box or is atleast 10 digits long
|
|
and then press unlock.
|
|
|
|
Step 2:
|
|
you should be in Softice now at the point that our program
|
|
called the getdlgitemtexta function. press F11 to get back to
|
|
the code that called this. you should see something like the
|
|
code below
|
|
|
|
0137:00691ESC CALL [USER32!GetDlgItemTextA] <-- Call to get
|
|
0137:00691B92 MOV ECX,PFFFFFFF our unlock code
|
|
0137:00691E97 SUB EAX,EAX
|
|
0137:00691E99 REPNZ SCASB
|
|
0137:00691E9B NOT ECX
|
|
0137:00691E9D DEC ECX
|
|
0137:00691E9E CMP ECX,OA <-- Check to see if code is 10 digits
|
|
0137:00691EA1 JZ 00691EE3 <-- Jump if is
|
|
0137:00691EA3 LEA EAX,[ESP+74] <-- set msg for invalid code
|
|
0137:00691EA7 PUSH 006AC444
|
|
0137:00691EAC PUSH EAX <-- save msg
|
|
0137:00691BAD CALL 006A0370
|
|
0137:00691EB2 LEA EAX,[ESP+7C]
|
|
0137:00691EB6 ADD ESP,OS
|
|
0137:00691EB9 PUSH 30
|
|
|
|
ok as you can see here the program checks to see if we entered
|
|
a code that is 10 digits long and if we did then it will jump
|
|
to the code below if not then it displays a invalid code msg
|
|
|
|
0137;00691EE2 RET
|
|
0137:00691EE3 MOV EDI ,006B3ADO <-- we land here if code is 10
|
|
0137:00691EB8 MOV ECX ,FPFFFFFF
|
|
0137:00691EED SUB EAX ,SAX
|
|
|
|
ok now you will have to press F10 to single step though the code
|
|
till you come to the code below.
|
|
|
|
|
|
0137 :00691F1E CALL 006936EO <-- Generate real code here
|
|
0137 :00691F23 LEA ECX,ESP+4C) <-- if we do a ED ESP+4c here we get
|
|
0137 :00691F27 ADD ESP,OC the real code
|
|
0137 :00691F2A PUSH 006B84BO
|
|
0137 :00691F2P PUSH ECX <-- Save real code
|
|
0137 :00691230 CALL 006AA980 <-- call to compare our code with
|
|
0137 :00691F35 ADD ESP,OB real code.
|
|
|
|
I have skiped some code here just scroll down and
|
|
you will see this.
|
|
|
|
0137:00691F3A MOV EAX,[006B78B4]
|
|
0137:00691F3F JNZ 00691F53 <-- jump if code is invalid
|
|
0137:00691F41 MOV WORD PTR [EAX+04],0001
|
|
0137:00691F47 XOR EAX,EAX
|
|
0137:00691F49 POP EDI
|
|
0137;00691F4A POP ESI
|
|
0137:00691F4B POP EBX
|
|
0137:00691F4C ADD ESP,00000130
|
|
0137:00691F52 RET
|
|
0137:00691F53 LEA ECX,[ESP+74] <-- set up for invalid code msg
|
|
0137:00691F57 PUSH 006AC444
|
|
0137:00691F5C MOV WORD PTR [EAX+04,0000
|
|
0137:00691F62 PUSH ECX
|
|
0137:00691P63 CALL 006A0370
|
|
0137:00691F68 LEA ECX,[ESP+7C] (this may not be 7C as i cant remeber
|
|
i had changed it before i wrote
|
|
down the code) This is where we
|
|
will make our change inorder to
|
|
get our real number.
|
|
|
|
|
|
Ok damn that is a lot of code. well what is happening here is
|
|
our program (the Rsagnt32.dll is getting ready to give us
|
|
that damn " Sorry you fucked up message" the program
|
|
copies the strings we will see in the messagebox right here
|
|
to ECX then will push ECX in a few lines down but we dont want
|
|
it to push the message we want it to push our real code, dont
|
|
we. So we will need to make a few changes here. rememeber where i
|
|
siad our real code was?
|
|
|
|
:00691F23 LEA ECX,ESP+4C) <-- if we do a ED ESP+4c here we get
|
|
:00691F27 ADD ESP,OC the real code
|
|
|
|
well do you think you see what needs to be done?
|
|
yeah change the esp+7c to esp+4c right? Nope that want work.
|
|
If you do that you will only get the last 5 letters of the code
|
|
because the code starts before 4c do we need to do a ED esp+4c
|
|
and see what we get. hmm well what we want to see is our code
|
|
start on the first line of the data window like below
|
|
|
|
:009BEBD4 49505848 544E4A54 00005443 00000004 HXPITJNTCT.. .
|
|
:009BEEE4 00000000 00000000 02EF005C 02EF0004
|
|
:009BEEF4 034P3AAO 02EF7E3B 7P1R0500 18078394 0.> .....0....
|
|
:009BEF04 00004389 00000000 382780D4 40000000 C........'8...0
|
|
|
|
now to do this we will have to play with ESP so to save you time
|
|
i have found that ESP+48 will do the trick.
|
|
so what we will need to do is change LEA ECX,[ESP+7C] to
|
|
LEA ECX,[ESP+48] this will yield us a real code every time
|
|
in the place of that damn "Sorry you Fucked up message"
|
|
so now you can do one of 2 things (1) restart the registraion
|
|
process and when you get to the line with LEA ECX,[ESP+7C] on it
|
|
do a ED xxxx:00691F68 then write down what you see in the data
|
|
window so you can change it or i will give you the info
|
|
you willl need when you run your hexeditor
|
|
|
|
you will need 8D4C247C83C408 do a search for that in your
|
|
hexeditor (use Hiew it is the best) and replace the 7C with 48
|
|
and then save your file (make a back up before you do this though)
|
|
now when you run the program you will get a message that tell you
|
|
that a dll is corupted go on to the next step to fix that
|
|
|
|
step 3:
|
|
in the Main program file tx32.exe do the following:
|
|
ok in hiew search for 85C0752C50 then edit it in code mode
|
|
and change the jnz to jz or visa versa then there is one more
|
|
search for 85C0752E33FF and change its jnz to jz or visa versa
|
|
i cant remember if they are jnz or jz but what ever it is change
|
|
to the opisite. or you can do a BPX MESSAGEBOXA and find the
|
|
jumps on your own. (Hint addresses are :0041CD27 & :0041D267)
|
|
well that is about it after you make the changes you can run the
|
|
program and get you real number from it then register it.
|
|
Sorry if this is not as clear as most of my tut's but i only wrote
|
|
down the code that i needed while i was cracking and make notes
|
|
about the rest so if you have any trouble just find me on EFNET
|
|
in #cracking4newbies and i will be glad to explain.
|
|
|
|
Oh yeah you cant unregister the program after you register it
|
|
so make sure you get a good understanding of how it all werks
|
|
before you regiters the program.
|
|
|
|
|
|
Hope this Helps you to better understand Dll cracking and
|
|
makeing a msg box show you the real reg codes for your
|
|
program. _CbD_
|
|
|
|
Greetz to :
|
|
josephCo, nIabI, Mornings, ^pain^, drlan, mp, razzi and
|
|
all the rest of #Cracking4newbies
|