jonla_13.htm: BEGINNERS: A key-gen for AddItem

	BEGINNERS: KeyGenerator for AddItem: - Turning a NAG in to a keygen!	Not Assigned
12 February 1998	by Jon
	Courtesy of Fravia's page of reverse engineering
fra_00E4 980212 Jon 0000 NA XX	Well, as anyone knows we are not so much favourable to the publishing of key generators, why the hell should we allow all lamers of the planet to use stolen software? Yet in this case it's the protection scheme itself that is 'reversed' (changing a SINGLE byte) and used as a keygenerator... a nice essay for beginners, by Jon. Very useful for those among you that DO NOT KNOW how to work with Softice in order to fish simple echos. A useful lesson for shareware programmers as well, clearly the idea of pushing a "not valid registered number" location that can be turned into a "valid registered number" location changing a single byte is ludicrous to say the least. This is an essay for beginners (almost for NEWBYES) yet it may be enjoyed by any reverser	Related: Programmers' corner
	There is a crack, a crack in everything That's how the light gets in
Rating	(x)Beginner ( )Intermediate ( )Advanced ( )Expert

Useful for beginners, who haven't discovered the ease of "fishing" serials with SoftIce yet. I'll also show how to crack "creative": Turning a *NAG* in to a key-gen!

KeyGenerator for AddItem:
- Turning a *NAG* in to a keygen!
Written by Jon

Introduction

Greetings, all!



Today, I'll crack several nice little programs, all made by the shareware 

programmer Firas El-Hasan. His programs are all nice Window$-utilities,

that are pretty useful. But unfortunately they all have a *NAG* at launch,

which is really annoying, considering that the programs are probably all

made within a couple of hours...

The programs are:



SysDate - A program which shows you the day of the month in the system tray.

StartClean - Cleans shortcuts, that points to nonexisting files.

SysLaunch - A "lite" version of the start menu, for fast access of your

favorite apps.

QuickDesk - Minimizes all the windows with ALT+TAB, or by a click on the

tray icon.

HotCorners - Starts your screensaver, when you leave the mouse-pointer in

one of the desktop corners (nice!).

DirectNet - Automatically dials your ISP, and launches an Internet-app. of

your choice (useful?).

AddLink - Allows you to right-click on a program, and add it to the

start-menu.

Also: DOS-Explore and DialMSN (MSN??? Yucchh!!!), but they are freeware,

so no cracking is needed :-)



I'll use two different approaches to cracking the protection-schemes:

1. Using SoftIce to "Hear the echo".

2. Using SoftIce/HIEW to turn the program in to a key-gen.



As a template, I'll use AddLink, which is one of the most useful of them.

Actually, StartClean is the most useful, but a dude named Qapla has already

made a tutorial for that program (good work, BTW). 

I'll describe the crack in a way, that'll make it easy apply the same 

approach on the other programs. And I'll also describe, if there's 

something that you should take note of, when using the same approach on the

other programs...

Tools required

SoftIce 3.22 for Win95/NT (any version is useful, though).
HIEW 5.66 (or whatever hex-editor you prefer).

Target's URL/FTP

You can fetch the apps. at the authors homepage:
http://users.aol.com/felhasan/

Program History

None that I know of (I stumbled over the apps. by coincidence)... Check out the authors homepage, for more info.

Essay

So let's begin!



Start by installing AddLink (or one of the apps., that you wish to crack).

Start AddLink by right-clicking on any file, select Send To -->  Start Menu.

A nasty *NAG* will show, and remind you to "pay" for the program. Go in to 

SoftIce (CTRL+D) and

BPX Lstrcmp

Press F5 to get out of SoftIce...

Select Register...

Enter your name (in my case): -=[JON!]=-

And a fake serial: 1212121212 (Copyright © +ORC)

Hit ENTER...

Now, SoftIce BREAKS at Lstrcmp!

Type:

BC *

To clear the breakpoint.

Press F11 to go back, where it was CALLed from, scroll up a little, and you

see this:



CALL   00401BB0           ;Calculate valid code.

LEA    EAX,[ESP+18]       ;Copy your code to EAX.

ADD    ESP,08

PUSH   EAX                ;PUSH your code.

PUSH   004051C8           ;PUSH valid code.

CALL   [Kernel32!lstrcmp] ;Compare strings.

TEST   EAX,EAX            ;Are you registered?

JNZ    00401BA5           ;If not, JMP to *NAG*!



Now, to retrieve the valid code, you'll need to set a breakpoint on the line

where your code is PUSHed. To do this, simply double-click on that line. 

(If you have mouse disabled, do a BPX XXXX:YYYYYYYY, where XXXX:YYYYYYYY is

the memory location). Now, go out of SoftIce and enter the name and a bogus

code again. Press OK, and SoftIce breaks again. Type:

BD *

to temporarily disable the breakpoint (it will be used later).

Type:

D 004051C8

And you discover that the valid code for the name -=[JON!]=- is:

14621-136061-2316-6752.

But why stop here? Why not make a key-gen? To do so, UNREGISTER the program,

by deleting its registry-entries (HKEY_CURRENT_USER\SOFTWARE\ADDLINK).

Now that it's unregistered, start the program, go in to SoftIce and enable

your breakpoint once again:

BE *

Enter something fake and press OK. SoftIce breaks once again, where the

valid code is PUSHed. 

Clear your breakpoint:

BC *

Now, write down the HEX-numbers for the PUSH function: 68C8514000

68C8514000 	PUSH   004051C8          ;PUSH valid code.

Keep pressing F10, until you see these lines of code:



PUSH   00

PUSH   00

PUSH   004051B4             ;PUSH the text "Incorrect code!"

PUSH   ESI

CALL   [USER32!MessageBoxA] ;CALL the *NAG* dialog.

MOV    EAX,00000001         ;Set EAX=1 (unregistered).



Now, type:

E XXXX:YYYYYYYY

Where XXXX:YYYYYYYY is the memory-location of PUSH   004051B4

Enter the hex-digits you've written down (68C851400).

Press F5 to get out of SoftIce, and what shows before your eyes?! A *NAG*

with the valid code for your name!!! Cool, huh?

To make the crack permanent:

HIEW ADDLINK.EXE

Search, F7: 6A006A0068B451400056

                      ^^

Replace   : 6A006A0068C851400056



Save (F9) and exit (F10), and you've got yourself a working key-generator!



6A006A0068B451400056  ;push incorrect code has been changed into

6A006A0068C851400056  ;push correct code



This can be applied to all the other apps. (some minor differences, of

course), with the exception of QuickDesk and SysLaunch. This is because,

the memory location in which the valid serial is stored is overwritten

before the *NAG* is shown :-( But you can, of course 

still "fish" a serial, using the same method described above.

Final Notes

What have we learned?

1.If Lstrcmp is used the compare the codes, it's easy to locate the right 

one, since it has already been calculated!

2. If the programmer hasn't cleared the valid code before the "Incorrect

code!" *NAG*, we can in most cases turn our worst enemy in to a key-gen!

3. The shareware programmers should make the protection-schemes different 

if they have more that one product!

4. SoftIce is the best debugger!

5. Cracking rulez!



Greetings:

+ORC, The +HCU, Fravia+, +Gthorne, all (+)crackers, all the cool cracking 

groups, all those who have killed a spammer, and of course to you, reader of

this essay!



Have Fun! :-)



By Jon, February 9th, 1998.

PS:

If you have any comments on this crap (good or bad), don't hesitate to

e-mail me at: jon101514(at)cyberjunkie(point)com

Ob Duh

I wont even bother explaining you that you should BUY these target programs if you intend to use them for a longer period than the allowed one. Should you want to STEAL this software instead, you don't need to crack its protection schemes at all: you'll find it on most Warez sites, complete and already regged, farewell.

You are deep inside fravia's page of reverse engineering, choose your way out:

homepage links search_forms +ORC students' essays academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_fravia+
Is reverse engineering legal?