411 lines
22 KiB
Plaintext
411 lines
22 KiB
Plaintext
HOW TO CRACK, by +ORC, A TUTORIAL
|
||
LESSON C (1) - How to crack, Cracking as an art
|
||
[BARCODES] [INSTANT ACCESS]
|
||
|
||
[BARCODES]
|
||
First of all, let me stress the importance of cracking in
|
||
our everyday life. Cracking it's not just about software, it's
|
||
about information, about all patterns of life. To crack is to
|
||
refuse to be controlled and used by others, to crack is to be
|
||
free. But you must also be yourself free from petty conventions
|
||
in order to crack properly.
|
||
You must learn to discerne cracking possibilities all around
|
||
yourself, and believe me, the development of this ghastly society
|
||
brings every day new codes, protections and concealing
|
||
mechanismes.
|
||
All around us grows a world of codes and secret and not so
|
||
secret patterns. Codes that are at times so familiar and common
|
||
that we do not even notice them any more... and yet they are
|
||
there to fool us, and yet they offer marvellous cracking
|
||
possibilities.
|
||
|
||
Let's take as an striking example BARCODES... those little
|
||
lines that you see on any book you buy, on any bottle you get,
|
||
on any item around you... do you know how they work? If you do
|
||
not you may be excused, but you cannot be excused if you never
|
||
had the impulse to understand them... crackers are curious by
|
||
nature... heirs of an almost extinct race of researchers that has
|
||
nothing in common with the television slaves and the publicity
|
||
and trend zombies around us. Cracker should always be capable of
|
||
going beyond the obvious, seek knowledge where others do not see
|
||
and do not venture.
|
||
|
||
[BARCODE HISTORY]
|
||
Let's begin with a little history. Universal Product Code
|
||
(UPC) was adopted for commercial use by the grocery industry in
|
||
the USA. Among the advantages were a rapid, accurate and reliable
|
||
way of entering stock information into a computer and the
|
||
possibility to sack a lot of workers and to do more profit. The
|
||
early success led to the development of the European Article
|
||
Numbering System (EAN), a symbology similar to UPC, that is
|
||
widely used in Europe and in the rest of the World. I'll teach
|
||
you to crack this one, since I do not -fortunately- live in the
|
||
States. Keep in mind, anyway, that there are different barcode
|
||
symbologies, each with its own particular pattern of bars. The
|
||
UPC/EAN code used on retail products is an all-numeric code; so
|
||
is the Interleaved 2 of 5 Code. Code 39 includes upper case
|
||
letters, digits, and a few symbols. Code 128 includes every
|
||
printable and unprintable ASCII character code. The most new one
|
||
is a 2-D code. These are special rectangular codes, called
|
||
stacked barcodes or matrix codes. They can store considerably
|
||
more information than a standard barcode. They require special
|
||
readers which cost more than a standard scanner. The practical
|
||
limit for a standard barcode depends on a number of factors, but
|
||
20 to 25 characters is an approximate maximum. For applications
|
||
that need more data, matrix codes are used. For example, the next
|
||
time you receive a package from United Parcel Service look for
|
||
a small square label with a pattern of dots and a small bullseye
|
||
in the centre. This is a MaxiCode label, and it is used by UPS
|
||
for automatic destination sortition.
|
||
The manufacturer's ID number on the barcode uniquely
|
||
identifies products. These numbers are managed by the Uniform
|
||
Code Council in Dayton, Ohio for the States and Canada and by the
|
||
EAN authority (Internationale Article Numbering Association) in
|
||
Bruxelles, for Europe and the rest of the World. The
|
||
manufacturer's ID number accounts for some digits of the code,
|
||
which leaves other digits to be assigned in any way the producer
|
||
wants. He provides retail outlets with a list of his products and
|
||
their assigned codes so that they can be entered in the cash
|
||
register system. Many codes are NOT on the products and are added
|
||
by the supermarkets on the fly, using an internal code schema
|
||
that may be non standard. Now it's enough... let's crack.
|
||
BARCODES are the only thing an automated casher needs to see
|
||
on a product to calculate its price and automatically catalogate
|
||
the sold merchandise... imagine (just imagine it :=) coz it would
|
||
be extremely illegal to act in this way) somebody would fasten
|
||
an adhesive home-made codebar label direct on the top of the
|
||
supermarket/mall/retail store label, say on a bottle of Pomerol
|
||
(that's a very good but unfortunately very expensive french
|
||
wine).
|
||
The new label would mean for the casher something like
|
||
"cheap wine from Bordeaux, France, cost so and so, everything
|
||
it's OK, do not worry"... do you think that anybody would come
|
||
to the idea that there is something wrong with the label, with
|
||
the bottle or with you? I have been codebaring for years and had
|
||
only once a problem, coz my printer was running out of ink and
|
||
the scanner in the supermarket could not read it... so what? Act
|
||
uninterested, always wear jackets of the utmost quality, shetland
|
||
pullovers and beautiful expensive shoes... (all articles that you
|
||
may codebar too, by the way), in this society appearance and look
|
||
count much more than substance and knowledge... LET'S USE THIS
|
||
TO OUR ADVANTAGE! Nobody will ever come to the idea that you may
|
||
actually really know the working of the scheme... coz codebar is
|
||
pretty complicated and not exactly exceptionally public. On the
|
||
Web there are a lot information about it, but most of them are
|
||
useless, unless you know how to search most of the time you'll
|
||
find only sentences like this one:
|
||
"The calculated check digit is the twelfth and final
|
||
digit in the U.P.C.code. It is calculated based on a
|
||
specific algorithm, and is necessary to ensure that
|
||
the number is read or key-entered correctly."
|
||
|
||
But good +ORC will now explain you everything you need to crack:
|
||
|
||
[THE 13 BAR "CODES"]
|
||
Each barcode label has 13 values, from #0 to #12 (that's the EAN
|
||
code, the UPC american one has only 12, from #0 to #11).
|
||
#0 and #1 indicate the origin of the product.
|
||
#2 to #11 give the article code
|
||
#12 (the last and 13th one) is a checksum value, that
|
||
verifies the validity of all the other numbers.
|
||
How is it calculated? #12 is calculated in 4 steps
|
||
VALUE A: You sum odd position numbers (#0+#2+#4+#6+#8+#10)
|
||
VALUE B: You sum even position numbers and multiply by 3
|
||
((#1+#3+#5+#7+#9+#11)*3)
|
||
VALUE C: You sum value A and value B
|
||
VALUE D: You mod value C (you divide by 10 and only keep
|
||
the remaining units, a very widespread checking scheme as
|
||
you'll see in the software part of this lesson)
|
||
If the result is not zero, you subtract it from 10.
|
||
Now look at a barcode label, get some books or other barcoded
|
||
items and *watch* it...
|
||
Bar codes are supposed to have "quiet zones" on either side of
|
||
the symbol. Quiet zones are blank areas, free of any printing or
|
||
marks,typically 10 times the width of the narrowest bar or space
|
||
in the bar code. Failure to allow adequate space on either side
|
||
of the symbol for quiet zones can make it impossible to read the
|
||
bar code.
|
||
|
||
On the barcode there are two "borders", left and right, and a
|
||
"middle" longer line. These three lines are longer than the
|
||
others and are used to "regulate" the scanner to whatever
|
||
dimension has been used for the barcode.
|
||
#0 dwells left of the first (left) border and has a special
|
||
meaning, the other 12 numbers are written "inside" the code and
|
||
are divided in two "groups" by the middle bar.
|
||
Each value is coded through SEVEN bars: black=1 and White=0.
|
||
These form two couples of "optic" bars of different widths.
|
||
We come now to the "magic" part: In order to bluff the
|
||
simpletons, barcode uses three different SETS of characters to
|
||
represent the values 0-9. This should make it impossible for you
|
||
to understand what's going on, as usual, in this society, slaves
|
||
should not need to worry with the real functioning of things.
|
||
Here are the graphic codes of the three graphic sets:
|
||
|
||
CODE A CODE B (XOR C) CODE C (NOT A)
|
||
0: 0001101 (13) 0100111 (39) 1110010 (114)
|
||
1: 0011001 (25) 0110011 (51) 1100110 (102)
|
||
2: 0010011 (19) 0011011 (27) 1101100 (108)
|
||
3: 0111101 (61) 0100001 (33) 1000010 (066)
|
||
4: 0100011 (35) 0011101 (29) 1011100 (092)
|
||
5: 0110001 (49) 0111001 (57) 1001110 (078)
|
||
6: 0101111 (47) 0000101 (05) 1010000 (080)
|
||
7: 0111011 (59) 0010001 (17) 1000100 (068)
|
||
8: 0110111 (55) 0001001 (09) 1001000 (072)
|
||
|
||
9: 0001011 (11) 0010111 (23) 1110100 (116)
|
||
|
||
Borders: 101
|
||
Centre: 01010
|
||
|
||
- The C graphic set is a "NOT A" graphic set.
|
||
- The B graphic set is a "XOR C" graphic set.
|
||
- each value has two couples of bars with different widths
|
||
|
||
Now watch some labels yourself... see the difference between the
|
||
numbers left and the numbers right? The first "half" of the
|
||
barcode is coded using sets A and B, the second "half" using set
|
||
C. As if that were not enough, A and B are used inside the first
|
||
"half" in a combination that varies and depends from value #0,
|
||
following 10 different patterns:
|
||
#1 #2 #3 #4 #5 #6
|
||
0 A A A A A A
|
||
1 A A B A B B
|
||
2 A A B B A B
|
||
3 A A B B B A
|
||
4 A B A A B B
|
||
5 A B B A A B
|
||
6 A B B B A A
|
||
7 A B A B A B
|
||
8 A B A B B A
|
||
9 A B B A B A
|
||
|
||
"Ah! Stupid buyer will never understand why the same values gives
|
||
different bars! Nothing is as reliable as barcodes!" :=)
|
||
|
||
Let's take as example the codebar for Martini Dry:
|
||
BARCODE: 8 0 00570 00425 7
|
||
Let's see: we have a 8 0 0 = booze
|
||
Then a 000570 as ABABBA and a 004257 as C
|
||
"Even" sum: 8+0+5+0+0+2 = 15 (even sum)
|
||
Then a 0+0+7+0+4+5= 16 and 16 *3 = 48 (odd sum)
|
||
Then a 15+48=63
|
||
63 === 3
|
||
10 - 3 = 7 = checksum
|
||
Pattern = 8 = ABABBA CCCCCC
|
||
|
||
OK, one more example: Osborne Windows programming series Volume
|
||
2 General purpose API functions (always here on my table)...
|
||
BARCODE: 9 7 80078 81991 9
|
||
Let's see: we have a 9 7 8 = book
|
||
Then a 780078 as ABBABA and a 819919 as C
|
||
"Even" sum: 9+8+5+8+8+4 = 42 (even sum)
|
||
Then a 7+1+5+2+4+4= 23 and 23 * 3 = 69 (odd sum)
|
||
Then a 42+69=111
|
||
111 === 1
|
||
10 - 1 = 9 = checksum
|
||
Pattern = 9 = ABBABA
|
||
|
||
Well... what's the point of all this?
|
||
The point, my pupils, is that who DOES NOT KNOW is taken along
|
||
on a boat ride, who KNOWS and LEARNS can use his knowledge in
|
||
order to try to beat blue and black the loathsome consumistic
|
||
oligarchy where we are compelled to live. Try it out for
|
||
yourself... if you crack correctly and wisely your supermarket,
|
||
mall and library bills will be cut to almost zero.
|
||
Write a small program to print whichever codebar you fancy
|
||
(or whichever your mall uses) in whichever size on whichever sort
|
||
of label you (or better your targets) fancy... it's quickly done
|
||
with Visualbasic or Delphy... but you'll not find much on the Web
|
||
Alternatively you could also write, as I did long ago, a short
|
||
c program in dos, using a modified upper char set... and there
|
||
you are, have labels... see the world.
|
||
A small word of caution... crack only ONE item at time and
|
||
try it out first with the SAME label for the same product... i.e.
|
||
the correct code for that item, but on your own label. If it goes
|
||
through your program works good, if not, nobody will ever be able
|
||
to harm you. Anyway it never happens anything, never: the bar
|
||
code reading equipments have great tolerance, coz the scanners
|
||
must be able to recognize barcodes that have been printed on many
|
||
different medias. You should choose labels similar to the ones
|
||
effectively used only in order not to arise human suspects, coz
|
||
for all the scanner itself cares, your label could be pink with
|
||
green stripes and with orange hand-written, numbers. Mind you,
|
||
we are still just academically imagining hypothetical situations,
|
||
coz it would be extremely illegal to act in such an inconsiderate
|
||
manner.
|
||
CRACKING POWER! It's true for barcodes, for Telecom bills,
|
||
for Compuserve accounts, for Amexco cards, for banking cheques
|
||
(do you know what MICR is? Magnetic Ink Character Recognition...
|
||
the stylized little printing on the lower left of new cheques...
|
||
there is a whole cracking school working on it), for registration
|
||
numbers... you name it, they develope it, we crack it...
|
||
Begin with barcodes: it's easy, nice and pretty useful! Live
|
||
in opulence, with the dignity and affluence that should always
|
||
distinguish real crackers. Besides... you should see the
|
||
assortment of 'Pomerols' in my "Cave-a-vin" :=)
|
||
|
||
[INSTANT ACCESS]
|
||
The (c) Instant access routines are a commercial protection
|
||
scheme used to "unlock" complete commercial applications that
|
||
have been encrypted on CD-
|
||
ROMs which are distributed (mostly) through reviews.
|
||
This is an ideal cracking target: it's commercial software,
|
||
complete, uncrippled and of (relatively) prominent quality, that
|
||
you can get in tons for the price of a coke. Obviously this kind
|
||
of protection represents an ideal subject for our lessons. This
|
||
fairly intricate protection scheme has not yet been cracked by
|
||
anybody that I am aware of, anyway not publicly, therefore it's
|
||
an ideal candidate for a "strainer" to my university. I'll teach
|
||
you here how to crack it in three lessons, C.1, C.2 and C.3. I warn
|
||
you... it's a difficult cracking session, and this protection
|
||
represents quite an intellectual challenge. But if you are
|
||
seriously interested in our trade you will enjoy these lessons
|
||
more than anything else.
|
||
This cracking is intended as an "assignment" for my +HCU
|
||
"cracking university": you'll find inside lessons C.1 and C.2 a
|
||
relatively deep "introduction" to Instant access cracking. This
|
||
will teach you a lot anyway, and spare you hours of useless
|
||
roaming around, bringing you straight to the cracking point. But
|
||
I'll release the third part of this session, with the complete
|
||
solution (lesson C.3) on the Web only in october 1996, not a day
|
||
before. All the students that would like to apply to the Higher
|
||
Cracking University, opening on the web 01/01/1997, should work
|
||
in July, August and September (three months is more than enough
|
||
time) on this assignment. They should crack completely the
|
||
instant access scheme and send me their solutions, with a good
|
||
documentation of their cracking sessions, before 30/09/1996
|
||
(WATCH IT! You can crack this scheme in -at least- three
|
||
different paths, be careful and choose the *best* one. WATCH IT!
|
||
Some of the informations) in lesson C.1 and C.2 are slightly incorrect:
|
||
check it!).
|
||
There are four possibilities:
|
||
1) The candidate has not found the crack or his solution is
|
||
not enough documented or not enough viable... the candidate
|
||
is therefore not (yet) crack-able, he will not be admitted
|
||
to the +HCU 1997 curses, better luck in 1998;
|
||
2) The cracking solution proposed by the candidate is not as
|
||
good as mine (you'll judge for yourself in october) but it
|
||
works nevertheless... he'll be admitted at the 1997
|
||
courses;
|
||
3) The cracking solution of the candidate is more or less
|
||
equal to mine, he'll be admitted, personally monitored, and
|
||
he'll get all the material he needs to crack on higher
|
||
paths;
|
||
4) The cracking solution of the candidate is better than mine,
|
||
he'll be admitted, get all the material he wishes and asked
|
||
to teach us as well as study with us: "homines, dum docent,
|
||
discunt".
|
||
|
||
[Cracking Instant access]
|
||
The user that wants to "unlock" a software application
|
||
protected with (c) Instant Access must enter first of all a
|
||
REGISTRATION number string, which through a series of
|
||
mathematical manipulations gives birth to a special "product"
|
||
code. On the basis of this "product code" the user is asked to
|
||
phone the commercial protectors (and pay) in order to get a
|
||
special "unlock code" that will allow him to decrypt the relevant
|
||
software.
|
||
This kind of "passnumber" protection routines are widely
|
||
used for software unlocking, BBS access, server access, backdoor
|
||
opening and many other protection schemes. We have already seen
|
||
password cracks in different lessons of this tutorial (in
|
||
particular Lessons 3.1 and 3.2 for DOS and Lessons 8.1, 8.2 and
|
||
9.1 for WIN) albeit on a more simplistic scale: there it did
|
||
mostly not matter very much *HOW* you passed the protection: once
|
||
passed, you could have access to the application. This is not the
|
||
case with (c) Instant Access. Face it: it's a little boring, but
|
||
important that you learn how to defeat intricate protection
|
||
routines (you'll meet them often in the next years) and I believe
|
||
that the following example will give you a "feeling" for the
|
||
right cracking approach.
|
||
In this case we must not only "crack" this protection scheme
|
||
but also study it thoroughly in order to achieve our blessed
|
||
aims. This is a very good exercise: reverse disassembling will
|
||
teach you a lot of little tricks that you'll be able to use in
|
||
your other future cracking sessions.
|
||
Instant access (c) is a exceptionally widespread protection
|
||
scheme, and it should be relatively easy for you to gather some
|
||
encrypted software that has been protected with this method...
|
||
*DO IT QUICKLY!!* After the Web publishing of this lessons (I am
|
||
sending C.1 to 8 pages and 4 usenet groups on 25/06/1996) this
|
||
protection is obviously as dead as a Dodo. The "Accessors" guys
|
||
will have to conceive something smarter if they want to keep
|
||
selling "protections" to the lamer producers of "big" software.
|
||
BTW, if you are reading this and are working for some
|
||
commercial "protection" company, consider the possibility to
|
||
double cross your masters! Deliver me anonymously all the future
|
||
projects you are working on! That will amuse me, speed up the
|
||
advent of a true altruistic society and earn you the respect of
|
||
the better part of humanity.
|
||
As I said, many "huge" application are still protected with
|
||
this "Instant access" system. I have personally bought at least
|
||
7 or 8 "second hand" CD-ROMs packed full with Microsoft, Lotus,
|
||
Norton, Symantec, you name it, applications all "protected"
|
||
through this crap. The cost of this bunch of CD-ROMs was the
|
||
equivalent of a bottle of Dry Martini, maybe less. The same
|
||
software is sold, unlocked, to zombies and lusers for ludicrous
|
||
amounts of money.
|
||
Never buy CD-ROMs magazines when they appear! Be cool! Buy
|
||
them two or three months after the publishing date! Buy
|
||
"remainders" or "second hand" CD-ROM magazines "at kilo price"...
|
||
Come to think of it, never buy *anything* when it appears or when
|
||
some (paid) advertiser tells you to... remember that "trends",
|
||
"vogues", "fashions" and "modes" are only different names for the
|
||
whips that drill and chain the dull-witted slaves of this
|
||
loathsome society: "clever crackers consider cool, crack cheap,
|
||
cheat customary culture" (a rhetorical figure: an "Alliteration".
|
||
To defend yourself learn rhetoric... it's a more powerful and
|
||
more useful weapon than Kung-fu).
|
||
The "triple" password protection routine in (c) Instant
|
||
Access is very interesting from a cracker point of view. It's a
|
||
relatively complex scheme: I'll teach you to crack it in two
|
||
phases: First of all you must find the "allowed" registration
|
||
code, the one that "ignites" the "product code". We must crack
|
||
and understand this re_code first if we want to crack the rest.
|
||
Just for the records, I am cracking here (c) Action Instant
|
||
access version 1.0 (CD-ROM found on a old copy of "Personal
|
||
Computer World" of August 1994, packed full with encrypted Lotus,
|
||
Symantec, Claris and Wordperfect applications. Just to be sure
|
||
I crosschecked my results with another CD-ROM which also has
|
||
applications protected with (c) Instant Access: Paragon
|
||
Publishing's PC OFFICE: the protection scheme remains the same).
|
||
|
||
I am focusing for this lesson on the cracking of the specific
|
||
protection for the encrypted Symantec's Norton Utilities v.8.0.
|
||
Please refer to the previous lessons for the basic
|
||
techniques used in order to find the protection routine inside
|
||
our babe... for "low" cracking purposes you -basically- type a
|
||
number (in this case, where the input gets 10 numbers, we'll use
|
||
"1212-1212-12"), do your search inside the memory (s 30:0
|
||
lffffffff "your_string") and then set memory breakpoints on all
|
||
the relevant memory locations till winice pops (I know, I know,
|
||
buddies... there are more effective ways... but hold your mouth:
|
||
for now we'll keep them among us: let's make things a little
|
||
harder for the protectionists who read this... Besides: the old
|
||
approach works here flawlessly). After getting the Registration
|
||
window on screen the Winice standard procedure is:
|
||
:task ; how
|
||
:heap IABROWSE ; where & what
|
||
:hwnd IABROWSE ; get the Winhandle
|
||
:bpx [winhandle] WM_GETTEXT ; pinpoint code
|
||
:bpx GetProcAddress ; in case of funny routines
|
||
:dex 0 ds:dx ; let's see their name
|
||
:gdt ; sniff the selectors
|
||
:s 30:0 lffffffff "Your_input_string" ; search in 4 giga data
|
||
:bpr [all memory ranges for your string that are above 80000000]
|
||
and so on. (continued in lesson C.2)
|
||
|
||
Well, that's it for this lesson, reader. Not all lessons of my
|
||
tutorial are on the Web.
|
||
You 'll obtain the missing lessons IF AND ONLY IF you mail
|
||
me back (via anon.penet.fi) with some tricks of the trade I may
|
||
not know that YOU discovered. Mostly I'll actually know them
|
||
already, but if they are really new you'll be given full credit,
|
||
and even if they are not, should I judge that you rediscovered them
|
||
with your work, or that you actually did good work on them,
|
||
I'll send you the remaining lessons nevertheless. Your
|
||
suggestions and critics on the whole crap I wrote are also
|
||
welcomed.
|
||
+ORC an526164@anon.penet.fi
|