One more stupid protection (Explaining a very stupid quiver protection)
9 January 1999	by int24h
	Courtesy of Fravia's page of reverse engineering	slightly edited by fravia+
fra_00xx 98xxxx handle 1100 NA PC	Once more: never, never, never trust what the notes accompanying your software claim: you always better check everything yourself... if you'r a reverser, taht is :-) "Beware! If the user forgets his password, it will be impossible for him to access his account"... yeah? should really one of the poor 'clients' of this stupid target believe what the Author told him, he would be well advised to read the following... and don't be so naÔv to believe that this does not happen often enough elsewhere as well... current favourite sport by infowarfarer lusers on the web is to pick supposedly 'protected' and 'secure' zip and excel files from (stupid but countless) industrial sites... unfortunately (for them) all software is open like a sea... On waters far Where map-man never made survey, Gliding along in easy plight The strong reverser brake the lull of night You do remember your Herman, I hope...
	There is a crack, a crack in everything That's how the light gets in
Rating	(X)Beginner ( )Intermediate ( )Advanced ( )Expert

Pointage Express v1.0 is a french account manager. It's one of the four programs of TRIAGONE, a french society specialised in custom made programs. Their proggies are written in WINDEV. (Beware it's in french).

Essay

- Limitation

  The program can be used 30 times. On the 31th time it's locked!



- Type of protection

  name / serial number



  On the beginning, a nagscreen appears with a countdown of your

  remaining uses. You must click on the "Je suis d'accord" button (ie

  :I  Agree) to continue. On the background of the main window there

  is a text showing your unregistered status.



- Registration

  To register, clic on "?" then on the logo (a triangle).Enter your

  name and serial number.



  A bogus answer results in an error

  message.



1- How to defeat the protection



After a first run, i searched the Registry for new entries, in

HKCU\Software and HKLM\SOFTWARE but there was nothing about Pointage

Express!



- Load Regmon then "Pointage express.exe" .

- Two interesting lines appeared:

  

  HKCR\Log_tri.Config.Parameters\CPT    SUCCESS  "29"

  HKCR\Log_tri.Config.Parameters\LIC	NOTFOUND

  

  CPT stands for COMPTEUR (ie COUNTER)in decimal value.

  LIC stands for LICENCE  (ie LICENSE)



  On every load, CPT is decremented until you reach "0". What's funny

  is that you can change the value to whatever you want, say...10000

  :) But the nagscreen screen is still there :(



  Adding the string "LIC" with no value won't register you. After a

  few "searches" it appears that the registered format is:



  LIC="nnnnnnnnnncccccccc"



  n=characters, 10 are needed to fill up the serial number line.

  c=characters up to 32.



  For example a valid line could be:

  LIC="1F3-4H6-7Tint24h" or LIC="0123456789int24h"





2- How to retrieve the password of an account.



What the author says in the help file about protecting an account:



(translation)

" The fact to protect an account gives the owner of this account a

great confidentiality on his budget position."



"Beware! If the user forgets his password, it will be impossible for

him to access his account."



Well, that's not true!

In fact the name and the password (when existing) of an account

appears in CLEAR in two files, COMPTE.NDX and COMPTE.FIC.



- COMPTE.NDX



This file stores the name and the password (if existing) of any

account you created. The names are numerically/alphabetically

ordered, beginning at offset 0x80B. Two names are

spaced by 0x2D bytes. The passwords are stored the same way,

beginning at offset 0x140B and they are seprated by 0x19

bytes.



Changing a name or a password in this file will created an error on

the access of the modified account.



- COMPTE.FIC



Here, the names and the passwords are stored in the same order you

created them.

And so on...



If you modify the name or/and the password of an account, be sure to

use CAPITAL letters. And do the same changes in COMPTE.NDX .

Bah, we're not supposed to edit COMPTE.xxx files, but we like to know

what's on our system ...and how things work !



There are three other softwares on their site and the protection is

(you'll easily be able to find it out, but believe me, it is not worth it) ...the same!

homepage links search_forms +ORC how to protect academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_fravia+
Is reverse engineering legal?