If you want to crack W32Dasm7 (818720 Kb - Feb, 20 1997)  you must

consider two problems:

	

- How to get rid of the limitation that does not allow us to perform as

many operations as we want per session

- How to save the disassembly listing



Fortunately we, little crackers, took our time to read +ORC tutorials

extensively. So we know two important things:

1/ -Always use a ZEN method to analyse and then crack a program.

2/ -Commercial protectionists/programmers are mostly stupid.



OK, let's go:



1/-Always use a ZEN method to analyse and then crack a program.



First, disassemble W32Dasm7.exe with....W32Dasm7.exe. (cracking W32Dasm7

using W32Dasm7 that's zen!).



We'll get rid of the counter in order to use W32Dasm7 as many times as we

want (without limitations) AND in order to find how to save the disassembled

listing to disk.



I won't spent a lot of time to explain how W32Dasm7 counter works because

Adynts did it well for W32Demo6.

here

As we know that protectionists are stupid, let's assume that they used

the same protection scheme, and the SAME COUNTER! for W32Dasm7!

So we are looking for a counter that is decremented each time you press a

command:



We search for 'dec dword ptr' in the listing and.....right!! Poor nice

Urbanik used the same counter! We find several 'dec dword ptr [ebx+ xxxxxxxx]...

The one we find the more often is : DEC DWORD PTR [EBX + 00532739].

We just now have to find the 'mov dword ptr [ebx+00532739],0000012C '.

It is located at :



:0043F7FA     C783392753002C010000      mov dword ptr [ebx + 00532739],0000012C



We just have to change it as per follow:

           

:0043F7FA     C78339275300FF0F0000      mov dword ptr [ebx + 00532739],000FFFFF

                       

Done! The counter is cracked and now, just one little more thing to do:



Saving the desassembly to text file.

We could use SoftIce 3.00 to do this but as it took about 5mn to load

W32Dasm7 to get the desassembly listing let's use W32Dasm7 features (it's

always good to know all options and features of the program you are

cracking!):



In W32Dasm7, in the Toolbar press the "Functions Imports" button.

You'll get a list of all calls to external functions located in Windows

API.



You'll see that it uses the Kernel32.DeleteFileA function.

And what does such a function???? It deletes an existing file!



We know that W32Dasm7 creates a file called WINSYS located in the

directory of the file you loaded. It has the 'Hidden Attribute' and its

size is 0 Kb (that's just because it is 'open for reading' by W32Dasm7).

As usual, if a program wants to erase a file, it must close it. This

particularity applies to DeleteFileA too otherwise it will fail.

So, when quitting W32Dasm7 it will first close WINSYS and then erase it.

We must crack right after it will close it.



Press the "Find" button and search for 'DeleteFileA'.

You'll find 3 Calls to address :0047ABCC .



Press the "Goto Location" button and enter '0047ABCC' .

You'll get:



*Reference To: KERNEL32.DeleteFileA, Ord0000h

:0047ABCC    FF251CA74900  jmp dword ptr [0049A71C]



Here it is!!

Let's change these values:



:0047ABCC    C39090909090



'C3' is a RET (Return) in Assembler and '90' is a NOP (NO Operation).

This means that instead of jumping to Kernel32.DeleteFileA function, the

program will be sent back (RET) to the caller and then will exit WITHOUT

erasing Winsys.



DONE!!! We cracked W32DASM7.EXE.





Do these change with a good Hex Editor like Hiew550 or HexWorkshop (see

+ORC tutorial chapter 9(3) if you want to crack it too!).

Then fire your brand new cracked copy of W32Dasm7, load any file and then

exit the program. You'll see that WINSYS is still inside the directory of the

 targeted program without 'Hidden Attribute', so that you can now open it with 

any word processor, copy it, or move it elsewhere.



2/ -Commercial protectionists/programmers are stupid.

+ORC was right: The commercial purposes of their work makes them BLOODY

STUPID FOOLS!

I cracked W32Dasm7.exe WITH W32Dasm7.exe AND even had SoftIce 3.01 loaded

during that time and didn't have any problem!

It took me 2 hours to crack and write a patch for W32Demo7 but only 15 mn

to do the same with W32DASM6!! They are still using the EXACT SAME

protection scheme (same counter, same DeleteFileA, same Winsys...) and I

guess they will re-use it for the next version of W32Dasm.



Can't wait for W32Dasm8 !!!!

Frog's Print (Paris)

Since the file was attribbed incorrectly, it became clear to me that a part of the 

crack was sorely missing from the part placed online by Frog Prints. This does 

not belittle his work in any way, just points out the need to accomplish as much 

of a crack as possible before it goes to the presses and the world sees it.



Going under an assumption, which was correct mind you, this change fixes that 

problem:



search for: 77696E737973

change to:  77732e747874



I know why it works, and I knew why it would work as i thought of it.

It is left up to you, dear reader, to use a few moments of your time to 

figure it out.

If you give it a go, you will a least see WHAT was done, even if you do not 

understand why... But a little thought on it and it may just come to you, 

even if you know nothing about cracking.



The aforementioned change should therefore work for ALL versions of wdasm 

ever made, and hopefully even in the future.



Sometimes it is common sense that solves the puzzle, not necessarily the 

book knowledge or tools which we amass in the time we have.



ADDENDUM:

Here is a little addition that will make the above crack a little more user 

friendly:



Search for this byte pattern:

5361766520746F



And at that location, insert the following whole pattern in its place 

(starting at the first byte above.. I am only skipping spaces in order 

to allow you to read it more clearly)



44697361  7373656D

626C7920  53617665

640A546F  2046696C

653A2057  532E5458

540A0A3C  3C202B67

74686F72  6E652739

37203E3E  00



I do hope you try this, it is what cracking is all about - making 

programs even better... so you WANT to use them.



Take care my friends,

 +gthorne'97



PS: For those who came in late, or somehow have not gotten 

ahold of his file, here are the necessary fixes that Frog Prints 

published. I am not about to explain them again, that is for you

to locate his file and the one for wdasm6 for adntys.

This is his fix for the time counter:



Search for:

 C783392753002C010000

Replace with:

 C78339275300FF0F0000



Frog Print's 'Fix the deleter' Function reprinted here:



Search for:

 FF251CA74900

Replace with:

 C39090909090

------------------------------

'The road goes ever, ever on.'

   - J.R.R.Tolkien

------------------------------

---

You are deep inside fravia's page of reverse engineering, choose your way out:
homepage links anonymity +ORC students' essays
tools cocktails search_forms mailFraVia

surprise!



Here is (part of) the coveted map of my labyrinth:

index.html

	links.htm	

		private.htm

		cookie.htm

	orc.htm

		yamato.htm

		civetta.htm

		adynts.htm

		frogprin.htm