Adynt's essay
(how to crack wdasm)

by adynts

Courtesy of Fravia's page of reverse engineering
~
A good essay, adynts is a "clean cut" +cracker

Alright, you wanted to know how I cracked wdasm, so here it is :



I will crack here W32Dasm 6.4 [w32demo6.exe] which is 604 192 bytes long. 

There's two things to crack here. First, we want to do as many operations 

as we want during one session. We want also to be able to save the 

disassembly listing to a text file.



Part I : limited number of operations



This is the harder part of the crack, I did it sometime ago and I didn't 

use a very zen way. Here a much better way ( in my opinion ). We know 

that there is a counter, let's supose this counter is decremented each 

time. So there should be a dec each time you use command, so that dec 

should appear often. We have a 32bits application, so let's search in the 

disassembly listing for "dec dword ptr" whith grep. Using grep is 

important here for it allows you to see the multiples occurence of the 

same location. Here it is :





:004070E9 FF8B34674000            dec dword ptr [ebx+00406734]

:00407100 FF8B34674000            dec dword ptr [ebx+00406734]

:00407117 FF8B34674000            dec dword ptr [ebx+00406734]

:0042618F FF8B34674000            dec dword ptr [ebx+00406734]

:004261A6 FF8B34674000            dec dword ptr [ebx+00406734]

:004261BD FF8B34674000            dec dword ptr [ebx+00406734]

:004261F8 FF8BDE5E4000            dec dword ptr [ebx+00405EDE]

:00443923 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00443EC5 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00445281 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00445A9C FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00445E01 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00446090 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:004467F0 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:0044695D FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:0044795D FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00447A3A FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00448771 FF8B6E5A4000            dec dword ptr [ebx+00405A6E]

:00448782 FF8BDAE30100            dec dword ptr [ebx+0001E3DA]

:00448ED8 FF8B9E5F4000            dec dword ptr [ebx+00405F9E]

:00452A56 FF8BAA5D4000            dec dword ptr [ebx+00405DAA]

:00452CF1 FF8B9E5F4000            dec dword ptr [ebx+00405F9E]

:004531EC FF8BDEE30100            dec dword ptr [ebx+0001E3DE]

:00458610 FF8BDAE30100            dec dword ptr [ebx+0001E3DA]

:004586CC FF8BDAE30100            dec dword ptr [ebx+0001E3DA]

:00459AFA FF88EAE30100            dec dword ptr [eax+0001E3EA]

:00459B8A FF889E5D4000            dec dword ptr [eax+00405D9E]



So [ebx+0405DAA] is the one that appears the most often, let's look at 

that location closer. There is only one initialisation of this address, 

and many comparison, that looks nice, let's change the initialisation 

value :



   :00442381 C783AA5D40002C010000 mov dword ptr [ebx+405DAA], 0000012C

to replace with :

   :00442381 C783AA5D4000FFFF0F00 mov dword ptr [ebx+405DAA], 000FFFFF

 

And everything works nice.



Ok, the first time, I used winice, set a breakpoint when the window 

saying that you had to restart wdasm was poping. Then using backtracing I 

found a first location ( I think that was ebx+405F1A but my notes are not 

very easy to read ). And usr bpr I found the interesting location : 

ebx+00405DAA. That's not zen. Anyway I think the method I've described 

earlier is valuable even if I knew the solution before starting.





Part II : Saving in a text file



The routine to save in a text file is not in w32demo6.exe, so we connot 

use this way to enable the function save to text file. But w32demo6.exe 

is nice and in any case save the disassembly into a text file named 

winsys (in the same directory as the the program your are disassembling). 

This file is deleted when you quit the program. We just have to copy this 

file somewhere else while the program is running (in the background). The 

problem is that we do not have reading access to winsys. Let's change 

that. Looking at the disassembly listing and searching for winsys, you 

will find this section of code :



* Possible StringData Ref from Data Obj ->"\winsys"

                                  |

:004517AF 68BFEB4600              push 0046EBBF

:004517B4 8D838E5A4000            lea eax, [ebx+00405A8E]

:004517BA 50                      push eax

* Reference To: _strncat, Ord:0000h in cw3220.DLL

                                  |

:004517BB E87CC00000              call 0045D83C

:004517C0 83C40C                  add esp, 0000000C

:004517C3 8D8B8E5A4000            lea ecx, [ebx+00405A8E]

:004517C9 51                      push ecx

:004517CA 8D8300A13500            lea eax, [ebx+0035A100]

:004517D0 50                      push eax

* Reference To: lstrcpyA, Ord:0000h in KERNEL32.dll

                                  |

:004517D1 E878C00000              call 0045D84E

:004517D6 6A00                    push 00000000

:004517D8 6802010000              push 00000102

:004517DD 6A02                    push 00000002

:004517DF 8D93789F3500            lea edx, [ebx+00359F78]

:004517E5 52                      push edx

:004517E6 6A00                    push 00000000   






You are deep inside fravia's page of reverse engineering,  

choose your way out:




 homepage 

 links 



 anonymity 

 +ORC



 students' essays

 tools cocktails




 search_forms



 mailFraVia






 Is reverse engineering illegal?