Cracking Unlocker for newbyes
("Defeating Lame Commercial Protection Schemes")

by +DataPimp

(2 November 1997)

---

Courtesy of fravia's page of reverse engineering

Well, inside Softice, type "stack" and then hit enter to see a reference to unlocker... well deserved 'most stupid protection' award for an unlocker! This kind of protections should 'defend' the poor (mostly russian) shareware authors that have fallen in the hands of the "unbox.com" crooks! A stupid unlocker! I can't believe it: remember the old (yet really difficult) Instant access unlocking scheme? Look at this crap! An evident case of decadence of many 'Unlock' protection schemes...
+DataPimp style and approach are so basic that this essay could also be very useful for all NEWBYES in SOFTICE reversing.

Pasted below is a Essay on Unlocker, the protection found on all the 

software at www.unboxed.com, This explains how to crack it.

This is probably a good example of ready made (stupid) protection 

scheme.



-= +DataPimp =-





				   Cracking Unlocker

		    (Defeating Lame Commercial Protection Schemes)



				    by -= +DataPimp =-



	Unlocker is probably a well known security program, it allows 

a user to download the full version of software and then install it. 

All they have to do is call with the "Challenge Code" and "Wallet"

and boom enter the unlock code and you have the full version of software

unlocked on your hard drive..

	Ok, now first things first, go to www.unboxed.com and download 

any software you choose. Then after you do that you can run the program 

and choose "Unlock Now". Once you do that you will see an edit field for

enter an "Unlock Password" and "Challenge Code". Now our "tactic" for 

this

case is that we are going to "see" the push to the stack, "track" it and

"crack" the jump. This I beleive should be a prospect for the most 

stupid protection scheme. Due that the "validation" of the entered code is 

a simple easily crack conditional jump. 

Ok now run the program you downloaded, and choose "Unlock Now". 

Once you have done that hit (Control-D) and in the command window 

for Soft-Ice we are going to prepare to "intercept" a windows

message, "Gaudiest" to be exact. 

I tried "GetWindowText" and "GetWindowTextA" but these API were not 

the culprits in this case. Ok now to properly trap the "Gaudiest" 

function for the edit box we do the following, we need to get the

hWnd ID for the correct edit box. To do that we type "Hwnd unlocker" 

you will see all the id's for the program. 

Now once you have done that the first edit box that you see in the 

list is the culprit. We are now going to set a breakpoint on that 

"Gaudiest" function. Ok, type "bmsg hwndID wm_GetText"

The wm obviously meaning "WindowsMessage". 

Ok now that you have done that, we are now going to get out of 

winice by hitting (Control-D) and we are now going to click the 

"unlock" command button. Ok now the program should break 

when you click the button. OK now in the command window of winice type

"stack" and then hit enter to you see a reference to unlocker, 

there should only be one reference. Once you have found that reference 

write it down. 

Ok, now that you have down that clear your original breakpoint by 

typing "bc 0". 

Now set a new breakpoint on the address that you got from looking what 

was recently pushed on the stack. 

Ok now you "bpx address" for me it would be "bpx 2247:14B3". 

Ok, Now get out of Soft-Ice again via (Control-D) and 

then click the "Unlock" button again, it will break, ok now you will hit 

"F-10" to step through the program code line by line you will 

eventually see a "jnz 151F" about two lines down from a call to a 

function, could this be any more obvious? 

Why -as +ORC wrote- don't they just put a big neon green sign that 

says "HEY THE PROTECTION IS RIGHT HERE PATCH ME!!!" with blinking 

lights and all the effects that would point to it? 

Ok, hit "F10" down so the "jnz 151F" is highlighted. 

Now once you have down that, in the winice command window 

type "a address", the address is where the jnz command is, it's off 

to the left. 

Now type "jmp 151F" for the new command there and hit "enter" and then 

"enter" again. Then all you have to do is hit "F5" and you should see a 

screen that tells you that it was unlocked properly. Some people have 

been kind enough to point out to me the fact that this does not work on 

the older unboxed software, the program that I used for this example is 

called ConfigSafe, So I would say that this will only work on the newer 

stuff. I would also like to point out the fact that it could work on 

future or other versions in the past, the thing is that you will just 

have to look for the jump a little farther down, this is just an 

example, you may have to look at it yourself. 



I  hope this helped some people, 



P.S. 

Greetz to everyone in: #cracking4newbies,#fleet and #natosites	





Until Next Time,

-= +DataPimp =-

DataPimp@hotmail.com  

Back to Project 7 ("Most stupid protection")

---

> homepage links anonymity +ORC students' essays academy database
tools cocktails antismut CGI-scripts search_forms mail_fravia
Is reverse engineering legal?