Adobe's Pagemill Version 2
("Breakpoints on memory access, the 13C680 (15 days) count, registry jongling, stack adjusting")

by Kox
(25 July 1997, slightly edited by Fravia)

---

Courtesy of Fravia's page of reverse engineering

---

Well, a pretty interesting essay: Breakpoints on memory access, the 13C680 (15 days) count trick, registry jongling, stack adjusting, RegOpenKey and RegCreateKey and the laziness of today commercial programmers in a very straightforward crack which carries some sound elements of reverse engineering...

PageMill 2 (Late June version) by Kox

www.adobe.com or ftp://ftp.adobe.com/pub/adobe/pagemill/win/2.x/pmwtry5.exe





Tools you will need:



1.W32DASM 8.5 (Thank's Frog's Print)

2.Winice 3 (aka Godot) 	www.numega.com

3.Registry Monitor v3   www.ntinternals.com

4.UltraEdit32 (or your favourite text editor)



First of all ,i would like you to excuse me for any mistakes. As a matter of 

fact i am only a newbie.. (I started learning x86 assmbly 40 days ago).



And i would like to thank +ORC for such a wonderfull attempt to create 

more freedom in this world, and Fravia for hosting many interesting essays... 



Pagemill (in my point of view) is one of the best HTML tools on 

the market. The best thing about it is that it ain't sold by micro$oft.



I heard about it some time ago, and i decided to give it a go.



I downloaded the program (About 5.5 megs... Installed it... and 

run it.

It runs without any nag screens... yet after exiting a dialog pops 

up, informing me that i have only 14 days left for "try out"...



Well, let's check that...



- advance the system clock 3 months.

- run pagemill



A nasty dialog pops up, informing me that my "try out" period has 

expired.



Well, let's get the clock back to normal



- run pagemill again...

- the same dialog pops up again...



So this wanna be protection raised an "expiry" flag somewhere in my system



No problem



Windoze has raised some stop flag for programmers these days... In order 

to carry the infamous crappy windoze 95 logo, you have to go by the rules 

(and whose rules? micro$oft's ofcourse). 

That means you can no longer write to the MBR, nor access hardware directly.



So pagemill HAS to have its expiry flag in either one of two locations.



1. Some file in the ever expanding file list on your hard drive

2. The ever fat piece of slime they call the registry



Well, in order to check the 1st possiblity I used filemon... (An excellent 

file monitor utility, you can find it at www.ntinternal.com, alternatively 

you can use "WineXpose I/O").



But i found nothing ... all the files accessed before the "expired" dialog, 

are non-fishy files.



SO, let's switch over to possiblity no 2 (The registry approach)



run Registry Monitor v3 

(this little baby allows you to monitor registry calls, and version 3 

has filtering capabilities [i.e monitor target task only] ..highly 

recommended)



Well before the nag screen our target accessed 5-6 registry keys. 

The most noticeable one was:

"HKEY_CLASSES_ROOT\CCLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"



Ok ..let's delete this key....

1) Delete the key 

 "HKEY_CLASSES_ROOT\CCLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"

2) get our clock back to normal

3) run the prog again...



It runs fine...(We are still in the "try out" period)



Ok.. we now know how pagemill expires itself.



Ok .. search for "CLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}" in pagemill.exe

Maybe it's our lucky day and it isn't encrypted.



And Voila.. it's there.(Those lazy programmers at Adobe did not even bother about 

encrypting the key's name)



Time for some "dead listing" using w32dsm (Thanks Frog's Print, for this 

marvellous tool)



We start disassembling pagemill.exe

(This takes about 25 mins on my P100, and creates a 30 megs "alf" file too....

(time enough for the famous Martini-WODKA, unfortunately i ran out of WODKA,

so i'll just go and give my dog a ride :-)



Back to our cracking session.



Load your dead listing into UltraEdit32 (or your favourite text editor, or 

word processor)



search for "CLSID" 



and you'll find the following:



* StringData Ref from Data Obj ->"CLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"

                                  |

:0049411E 68403F5C00              push 005C3F40

:00494123 6800000080              push 80000000



* Reference To: ADVAPI32.RegOpenKeyA, Ord:012Dh

                                  |

:00494128 FF1580445D00            Call dword ptr [005D4480]

:0049412E 85C0                    test eax, eax     

:00494130 7505                    jne 00494137		; if the key exists

:00494132 BE01000000              mov esi, 00000001	; raise a flag





So let's browse a little inside our source code...

50-60 lines above that we find something very interesting...



* Reference To: MSVCRT.time, Ord:02CBh

                                  |

:004940F2 FF15F4525D00     Call dword ptr [005D52F4] ; get system time

:004940F8 83C404           add esp, 00000004	;get stack back to normal

:004940FB A1AC555C00       mov eax, [005C55AC]	; installation date

:00494100 0580C61300       add eax, 0013C680	; add 15 days

:00494105 3945A4           cmp dword ptr [ebp-5C], eax ; compare with currect date

:00494108 7F0B             jg 00494115			;if more than 15 days > trial expired	

:0049410A 8B45A4           mov eax, dword ptr [ebp-5C];smart user set clock before 

                                                        the installation date

:00494113 7E05             jle 0049411A ;jump if good user 



* Referenced by a Jump at Address:00494108(C)

|

:00494115 BE01000000       mov esi, 00000001	;jump here if trial expired



Well, commercial programmers are getting lazier everyday (thanks to expensive 

suits and cars :-)

They are using the famous "0013C680" number...

This number means "15 days" of the trial period, represented in seconds 

(60 secs X 60 mins X 24 hours X 15 days) = 1.296.000 Decimal and 0x13C680



We have the installation date at 005C55AC ..  

copy it to eax	

then we add 15 days to it...

Compare the value with current date (in seconds too) at [ebp-5C]

If the value is more than the current date >>> buzz off: trial finished



And also the prog is checking for smart users who set the clock to pre-install 

dates. And if so >> buzz off you wanna be smart user, we want your money



OK let's check to see where is 005C55AC is getting the install date from...

seach for "[005C55AC],"



nothing ....



Ok never mind, since i am lazy (every body says so these days, to cover up for

shortage of knowledge), lets patch this snippet of code...



:00494100 0580C61300              add eax, 0013C680

:00494105 3945A4                  cmp dword ptr [ebp-5C], eax 

:00494108 7F0B                    jg 00494115	;change to: push eax;pop eax 	

:0049410A 8B45A4                  mov eax, dword ptr [ebp-5C]

:0049410D 3905AC555C00            cmp dword ptr [005C55AC], eax ;

:00494113 7E05                    jle 0049411A	; change to: jmp 0049411A



Ok, lets check our work...



1) Advance the clock

2) run page mill

3) IT WORKS!



4) try out the program... let's open a file...

5) DAMN....The nasty dialog appeared again...



There must be another check at the file open routine!



OK ... 

delete the expiry registry key again.



Browse the code again...

search for "0013C680" ... and voila .. 4 occurances...



and they are using almost the same technique with the same variables



install date at:[005C55AC]

add 0013C680 

compare with current date.



Ok 



i first wanted to know what did those reside for..



So i set back the clock to normal date.



Then fired softice's symbol loader... loaded pagemill into it.



then i traced a couple of times, 

then set a break point on memory access for 005C55AC, the memory 

location where the install date dwells.



:bpmd 005C55AC rw

:crtl d



and soft ice pops up at the above code...

exit softice 

use the program as usual



Open a file with pagemill



soft ice pops again at :4958f9



Ok so :4958f9 is used for file open



exit soft ice.



save a file at pagemill



soft ice pops again at :51ec7f



so: 51ec7f is for file save



exit softice



run most of the function and softice will never pop..



So what is the 4th occurance in our dead listing for.



let's quit pagemill



Aha... soft ice pop up at: 495128



no we can breath tight.

We know every single date check routine in our target, and we gained 

quite a lot of good reverse enngineering information about our target:



FILE OPEN -> 4958F9

FILE SAVE -> 51EC7F

QUIT -> 495128



One very noticable thing is that none of the break point that occured 

were to write a value to 495128, as if the value was hardcoded inside 

the file...

If fact it is, at installtion time: the current time (in seconds) is 

written at that location (hehehehe... at Adobe they are patching their 

own code these days :-)



So lets do our home work "the lazy way" and patch all 4 relevant 

snippets of code...



But watch out! At the exit routine you have to disable both the 

jmp instructions (tracing through the code at that location will 

show you why)



Now run pagemill once more,

and it works! 

We try load, save, most of the functions... and the nasty expiration

dialog will never pop...



so we exit pagemill, back to windows... 

and the "remaining days" dialog pops up, telling us we have -139 days 

left for our try out.



So it works, target cracked...



But that "remainig days" reminder looks bad.

We need to get rid of it..

ok...



1) fire symbol loader again...

2) load pagemill

3) trace(F10) a couple of times, then 



:bpmd 005C55AC rw

the above line sets a break point whenever an instruction tried to read (r) or

write(w) to that location.



:Crtl d



Softice in the background, as usual

then we exit page mill and

soft ice pops up at 495128, the "quit" routine.



:00495123 A1AC555C00      mov eax, [005C55AC]

:00495128 0580C61300      add eax, 0013C680

:0049512D 3B45D4          cmp eax, dword ptr [ebp-2C]

:00495130 50              push eax

:00495131 58              pop eax

:00495132 8B4DD4          mov ecx, dword ptr [ebp-2C]

:00495135 390DAC555C00    cmp dword ptr [005C55AC], ecx

:0049513B 50              push eax			

:0049513C 58              pop eax 	

:0049513D 2BC1            sub eax, ecx

:0049513F B980510100      mov ecx, 00015180





Lets trace (F10) a little, till our nag dialog apears..

and we land here



:00495322 E81DFC0A00       Call 00544F44

:00495327 668B0D302D5700   mov cx, word ptr [00572D30]

:0049532E 6A01             push 00000001

:00495330 51               push ecx

:00495331 8D55DC           lea edx, dword ptr [ebp-24]

:00495334 6A01             push 00000001

:00495336 8D4DB0           lea ecx, dword ptr [ebp-50]

:00495339 52               push edx

:0049533A E81AAF0500       call 004F0259		; remaining days dialog call

:0049533F C645FC04         mov [ebp-04], 04

:00495343 E81A000000       call 00495362

:00495348 C645FC03         mov [ebp-04], 03



Lets patch this ...but wait... we can't use push and pop or nop

cause this way we would ruin our stack!

so lets see

we have 4 "doublewords pushes", that means that our stack pointer is 

decreased by 16 bytes, so we need to make 4 pops, or add 10(hex) to 

the stack



so we change the above code to look like



:00495334 6A01             push 00000001

:00495336 8D4DB0           lea ecx, dword ptr [ebp-50]

:00495339 52               push edx

:0049533A 83C410           add esp,10  ; get back stack as if function was called

:0049533D 50               push eax    ; just filling

:0049533E 58               pop eax     ;  some space

:0049533F C645FC04         mov [ebp-04], 04

:00495343 E81A000000       call 00495362



I think our patch is now finished, but i wanted to make this crack as complete as 

possible.



What if the program has already expired inside some poor lamer's machine??

He/she/it wont be able to delete the CLSID registry key... and our patch would 

be useless for this guy...



So back to our dead listing.

Searching again for the string "CLSID" we find 4 occurences, that look like this:



* StringData Ref from Data Obj ->"CLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"

                                  |

:0049411E 68403F5C00       push 005C3F40

:00494123 6800000080       push 80000000



* Reference To: ADVAPI32.RegOpenKeyA, Ord:012Dh

                                  |

:00494128 FF1580445D00     Call dword ptr [005D4480]

:0049412E 85C0             test eax, eax		;test if key is found

:00494130 7505             jne 00494137		    ;not found: go try pagemill

:00494132 BE01000000       mov esi, 00000001    ;found: flag "expiry" routine



Damn, i will not patch 4 more locations... so let's ZEN a little bit...

if the RegOpenKey fails then the...  

YES! That's it! We want the call to fail... and it will fail, of course, if we 

change the ascii value of the key inside our target!



So if we edit pagemill.exe and search for the string "CLSID" we'll find it 

several times, but we need to change only the one that reads



"CLSID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"



to something like



"KOXID\{9CFA8CF0-CD93-11d0-8ADE-080009B30D57}"



(I only changed the CLSID string, 'cause the other value may be randomly 

generated in other machines, whereby "CLSID" is a standard branch of the 

registry)



It's the only occurrence we need to change because this occurrence is used 

only by the RegOpenkeyA function... the others are used by the RegCreateKey 

function (You have to have some API manual to know that and -by the way- 

i don't have one :).

The most inportant lesson for Adobe to learn is that they should'nt have been 

agressive.

If pagemill didn't create that key... And if that would'nt have been very clear, 

like a black spot on ice, it would have taken me much more efforts to crack 

this...



Well, i guess that's it... CU l8r



Signed.            Kox





Quick patch data



Filesize: 2,126,848 bytes



Comparing files PageMill.bak and pagemill.exe

00093508: 7F 50

00093509: 0B 58

00093513: 7E EB

00094530: 7C 50

00094531: 1A 58

0009453B: 7F 50

0009453C: 0F 58

0009473A: E8 83

0009473B: 1A C4

0009473C: AF 10

0009473D: 05 50

0009473E: 00 58

00094D01: 7C 50

00094D02: 0B 58

00094D0C: 7E EB

0011E087: 7F 50

0011E088: 0A 58

0011E091: 7D EB

001C1D40: 43 4B

001C1D41: 4C 6F

001C1D42: 53 78





(c) Kox 1997, All rights reserved 

RegOpenKey 


#include shellapi.h



LONG RegOpenKey(hkey, lpszSubKey, lphkResult)



HKEY hkey;	             /* handle of an open key */

LPCSTR lpszSubKey;	     /* address of string for subkey to open */

HKEY FAR* lphkResult;	 /* address of handle of open key */





The RegOpenKey function opens the specified key. 



Parameter	Description



hkey	Identifies an open key (which can be HKEY_CLASSES_ROOT). 

The key opened by the RegOpenKey function is a subkey of the key 

identified by this parameter. This value should not be NULL. 

lpszSubKey	Points to a null-terminated string specifying the name 

of the subkey to open. 

lphkResult	Points to the handle of the key that is opened. 



Returns



The return value is ERROR_SUCCESS if the function is successful.

Otherwise, it is an error value.



Comments



Unlike the RegCreateKey function, the RegOpenKey function does 

not create the specified key if the key does not exist in the 

database. 



Example



The following example uses the RegOpenKey function to retrieve 

the handle of the StdFileEditing subkey, calls the RegQueryValue 

function to retrieve the name of an object handler, and then calls 

the RegDeleteKey function to delete the key if its value is 

nwappobj.dll: 



char szBuff[80];

LONG cb;

HKEY hkStdFileEditing;



if (RegOpenKey(HKEY_CLASSES_ROOT,

        "NewAppDocument\\protocol\\StdFileEditing",

        &hkStdFileEditing) == ERROR_SUCCESS) {



    cb = sizeof(szBuff);

    if (RegQueryValue(hkStdFileEditing,

            "handler",

            szBuff,

            &cb) == ERROR_SUCCESS

            && lstrcmpi("nwappobj.dll", szBuff) == 0)

        RegDeleteKey(hkStdFileEditing, "handler");



    RegCloseKey(hkStdFileEditing);

}





		  

RegCreateKey 




#include shellapi.h



LONG RegCreateKey(hkey, lpszSubKey, lphkResult)



HKEY hkey;	/* handle of an open key	*/

LPCSTR lpszSubKey;	/* address of string for subkey to open	*/

HKEY FAR* lphkResult;	/* address of handle of open key	*/





The RegCreateKey function creates the specified key. If the key already 

exists in the registration database, RegCreateKey opens it. 



Parameter	Description



hkey	Identifies an open key (which can be HKEY_CLASSES_ROOT). The key 

opened or created by the RegCreateKey function is a subkey of the key 

identified by the hkey parameter. This value should not be NULL. 

lpszSubKey	Points to a null-terminated string specifying the subkey to 

open or create. 

lphkResult	Points to the handle of the key that is opened or created. 



Returns



The return value is ERROR_SUCCESS if the function is successful. Otherwise, 

it is an error value. 



Comments



An application can create keys that are subordinate to the top level of the 

database by specifying HKEY_CLASSES_ROOT for the hKey parameter. An application 

can use the RegCreateKey function to create several keys at once. For example, 

an application could create a subkey four levels deep and the three preceding 

subkeys by specifying a string of the following form for the lpszSubKey 

parameter: 



subkey1\subkey2\subkey3\subkey4 



Example



The following example uses the RegCreateKey function to create the handle 

of a protocol, uses the RegSetValue function to set up the subkeys of the 

protocol, and then calls RegCloseKey to save the information in the database: 



HKEY hkProtocol;



if (RegCreateKey(HKEY_CLASSES_ROOT,             /* root            */

    "NewAppDocument\\protocol\\StdFileEditing", /* protocol string */

    &hkProtocol) != ERROR_SUCCESS)          /* protocol key handle */

        return FALSE;



RegSetValue(hkProtocol,          /* handle of protocol key         */

    "server",                    /* name of subkey                 */

    REG_SZ,                      /* required                       */

    "newapp.exe",                /* command to activate server     */

    10);                         /* text string size               */



RegSetValue(hkProtocol,          /* handle of protocol key         */

    "verb\\0",                   /* name of subkey                 */

    REG_SZ,                      /* required                       */

    "Edit",                      /* server should edit object      */

    4);                          /* text string size               */



RegCloseKey(hkProtocol);     /* closes protocol key and subkeys    */



See Also



RegCloseKey, RegOpenKey, RegSetValue 

homepage links anonymity +ORC students' essays tools cocktails
antismut search_forms mailFraVia
is reverse engineering legal?