Fravia:

the best way I feel I could show my gratitude for what 

I have learned from your page and the tens of other good

cracking resources I have come across would be to come

up with something substantial of my own to contribute

to the cracking world.  Thus I have remained silent until

now, honing my basic cracking skills that one day, I may

be worthy enough to join the ranks of the +HCU.



For now, I submit this essay on a very simple protection

scheme I found.  Despite being simple it has certain

unique facets that make it more than 'banal'.  Also,

it is a tool (or a set of tools) that could be handy

for any +cracker.

About our target:



.RTPatch Professional is a commercial patching

engine.  It comes with several utilities that aid

in software modification and distribution, such

as a file compare tool, string and byte searching

utils, complete with a file archiving system that

allows the creation of self-extracting setup files.

Of course, the main product here is the patching

engine, which compares files (or a set of files)

and produces a binary patch file to allow software

developers to quickly make and distribute software

updates or bug patches.



This tool is especially useful for beginning crackers

like myself who do not yet have the capability of

programming their own patch files or even for

crackers who are experienced in programming but are

too busy to write a patch file for every software

they crack.  The crack files written by +crackers

themselves are often far more efficient (especially

in terms of file size) and already you may find

+cracker written patch generators/engines all over

the web.  I have already seen crack patches made by

this program on the web, and the hundred plus KB size

was a monster to download compared to the other 2 KB

crack files.  So what's so great about .RTPatch?



For starters, patches by .RTPatch are really small,

about a few hundred bytes.  It's the patch apply

programs which are relatively big (62 KB for DOS,

149 KB for Win32), and this is because these patch

apply programs have many fully customizable options.

Windows based patches can be made in an instant,

complete with a GUI (it's a bloated DLL file which

accounts for the size mentioned).  .RTPatch is easy

to use, and one of it's best features in my opinion

is ease of multiple file patching, along with add

and remove file capabilities.  But you can read

about this and other features in the complete

documentation that comes in the distribution file,

so enough of that here.                           



The most important thing about .RTPatch is that it

seems to be the defacto standard for binary file

patching in the commercial software world.  What

makes me say this?  Patches for Adobe and Symantec

applications use .RTPatch, as well as many other

corporate and non-corporate software developers

listed on Pocketsoft's web site.  So when these

companies issue patches for their software, having

the utilities they used to make their patches with

will enable us to reverse engineer them.  (May I

suggest the reverse engineering of RTP files as a

future +HCU Project?)  Lastly, it would pretty damn

ironic for us to be cracking and patching those

commercial applications with the same commercial

utility they're all using.  Let's use their own

tools against them.



  

The Protection



The .RTPatch Professional Evaluation Release is a fully

functional version with all the tools and documentation

included.  The evaluation period is for 30 days, but

Pocketsoft was probably counting on your honor because

the software doesn't seem to expire.  I've changed my

date ahead as far as the year 2099 and it still works

without handicap.  There seems to be two apparent

'protections' on this evaluation version:



1)  There is an annoying nag screen/message every time

the patch build and patch apply programs for all

platforms (DOS, Win, Win32) are invoked.



2)  According to the documentation, the eval release is

not capable of processing files larger than 25 megabytes.



These cracks are so simple that I won't even be putting

a line of code for them here.  I guarantee you, however,

you will have fun, since .RTPatch is multi-OS and

presents an opportunity to review your cracking skills

in DOS, Win16 and of course, Win32.  But here are the

guideline hints - this is, after all a cracking essay:



-The nags appear in 9 programs which need to be patched.  These are:

        PATCHBLD.EXE       the Win32 Console App which generates

                           the .RTPatch files

        PBLD-V16.EXE       the standard DOS version of PATCHBLD

        PATCHW32.DLL       the Win32 DLL for Console and GUI Patch

                           Apply Programs (the nag is in this DLL

                           and not the Apply Programs)

        PATCHW.DLL         this is the DLL for the Win16 GUI

                           Patch Apply.

 

 .RTPatch has an EZPatch system which allows you to

 bind the patch file and the apply program into a

 single executable patching file.  It uses DAT files,

 which are really modified versions of the corresponding

 standard EXE and DLL files with DAT extensions.

        EZPNTDLL.DAT       the 'bindable' version of PATCHW32.DLL

        EZPDLL.DAT         the 'bindable' version of PATCHW.DLL

        EZP32DLL.DAT       a 'bindable' combined graphic GUI and DLL

 

 These two files, we'll deal with later.

        PATCHDOS.EXE       the DOS Patch Apply Program

        EZPDOS.DAT         the 'bindable' version of PATCHDOS



-PATCHBLD.EXE is a Win32 Console App and thus uses

standard Win32 APIs.  Its nagscreen occurs as a

message box.  Using SoftICE, bpx MessageBoxA and

you'll find the call.  NOPping this call will get

rid of the call.  Secondly, the 25 MB limit can be

taken care of here.  Running PATCHBLD with any two

files larger than 25 MB will yield the error message

(I used my DriveSpace Compressed Volume Files).

Step the program to the error message display.  A

few instructions before that you will find a CMP

with 19h (25) and a JGE.  You know what to do.



-While you're still in Windows, crack the two DLL

files.  FIrst, make a patch file using an original

copy of the nagged, limited PATCHBLD and your newly

patched one, using PATCHBLD itself.  Next, use the

Win32 Patch Apply GUI (there's an icon in your Start

Menu) to apply the RTP file you just made.  A message

Box will appear.  Your bpx on MessageBoxA from your

last crack will catch it, and just NOP the call to

the API in PATCHW32.DLL.  There will be no more nag.



-PATCHW.DLL is cracked similarly, but remember that

it is 16-bit and uses 16-bit APIs.  NOPping the call

this time will crash the program, and so will NOPping

the call that calls the call, so at the top of the

routine that calls the nag force an early RETF by

changing the first byte to a CBh.  It's cracked.



-EZPNTDLL.DAT and EZPDLL.DAT are not exactly like

their standard DLL counterparts, but they're similar

enough that all you have to do is search the same

sequences of bytes that you NOPped in PATCHW32.DLL

and PATCHW.DLL and NOP them too.



-When you're done with all this, you can leave Window$

to crack PBLD-V16.EXE.  I know that you can load DOS

programs into SoftICE 3.x in Windows but it always

crashed on me so I decided that I would just crack it

in DOS.  Load it into SoftICE 2.x and step to the

message.  You'll be dragged throgh a lot of procedures

to get to the nag routine, so be prepared to step into

them.  Eventually you'll find the right one - RETF the

first byte of the called procedure to skip the nag.

There are actually 2 patch creation programs for DOS -

the standard PBLD-V16.EXE and the enhanced, faster

PBLD-DX.EXE, both of which have nags.  However, after

patching PBLD-V16.EXE, you won't need to patch PBLD-DX.EXE

anymore since the nag there also goes away.



By this point, most of the nags are gone and it probably

took you more experienced crackers about 10 minutes or less.





More Protection?



Well, I tried my newly nag-free Patch apply program on a

commercial software update .RTP file and I got an error

message 'Invalid Patch FIle.'  But most companies are

still using .RTPatch version 3.20, like the patch file I

was trying to use, and I figured the error was just due

to a version incompatibility.



PATCHDOS.EXE is a packed EXE file, and all the tools

I've gathered off the web say it's an unknown packer.

Rather than go through the trouble of unpacking this

compressed exe just for a simple nag, I went back to

the Pocketsoft web site.  In their downloads area I

found that PATCHDOS.EXE 4.00 was available for free

download.  Excitedly I got this 63 KB file and rejoiced

when I found it had no nag screen.  But when I tried it

on the patch files I made using PATCHBLD.EXE I got

another 'Invalid Patch File' message.  Perhaps it only

works with patches made with the DOS programs, I thought.

But even with patches created with PBLD-DX and PBLD-V16

I got the same error.  Could it be that my patching of

the nagscreens caused the patch builders to churn out

defective patch files?



The answer was no.  The RTP files I had made worked well

with Patch Apply Programs SUPPLIED WITH THE EVAL RELEASE!

I then tried the commercial version 3.20 RTP file with

the new PATCHDOS.EXE 4.00 that I had acquired.  It

worked perfectly!



So that is why the Evaluation Release of .RTPatch

Professional 4.00 was seemingly so poorly protected!

The Eval Release doesn't work with the Licensed

Release -- at least, it's not supposed to.  If that

is the case, yes, we've cracked .RTPatch and can now

make our own patches without any annoying nags, BUT,

how can we work with the RTP files of the commercial

software makers? Must we buy this extremely overpriced

patch engine to reap all its benefits?  Overpriced, of

course, since there are dozens of FREE utilities on

the web that do the same thing - written by +crackers,

for +crackers.



The answer is also no.  And if you're the type that doesn't

give up easily, you'll soon discover that the crack for

this part of the protection is very easy.  In fact, you

can give your SoftICE a rest and enter the battlefield

armed only with a hex editor.



There are two things to consider as we tackle this problem:



1)  The Patch Building System has to be capable of

writing a RTP file that is recognizable to the Patch Apply System.



2)  The Patch Apply System must have a method for

recognizing a valid RTP file.



Since you're probably still in DOS, you had best stay

there for the moment.  This session will end in DOS.

However, I made this observation in Window$, since my

Windows Hex Editor (Hex Workshop) allowed me to look

at several files at once.  I loaded a few of the

commercial RTP files I had, and then a few of the RTP

files I had made.  The file contents were different,

but I noticed that the headers of all the RTP files

were the same -- except for one thing.  The files I

had made with the Eval Release all began with EE 76 90 01,

while the commercial RTP files I had began with 4B 2A 40 01.

The Patch Apply Programs were reading in these first 4 bytes

to determine whether or not the RTP file was valid.

Testing this theory by editing the bytes worked.



At this point a simple solution would be to generate a

patch or write a program that would be capable of

searching EE 76 90 01 and replacing with 4B 2A 40 01

and vice versa to allow any patch file to work with

either the Eval or the Licensed Versions.  But this

would be cumbersome and inconvenient.  Besides, I want

the full product.



Fire up Hacker's View and switch to disassembly view.

Starting with PBLD-V16.EXE, we first search for

instances of EE 76 90 01.  No luck.  Reversing the

byte order also turns up nothing.  Then you search for

3 of the bytes in sequence.  Also no luck.  But

searching for EE 76 turns up two spots.  Searching

for 90 01 turns up thirteen.  How do we know which

ones to patch?  Time for the Zen part.



We're using Hacker's View since it can display in assembly.

As a result we can jump over red herrings and fish out the

right instructions.  The first instance of EE 76 is a CMP

instruction.  We know that this cannot be our target

because a CMP would not lead to writing on a RTP file.

The second one reads:



00043E44: C746FAEE76     mov    w,[bp][-0006],076EE



A MOV instruction would be very likely in writing that

sequence to the RTP file.  You then replace EE 76 with

4B 2A, the first 2 bytes of a licensed file header.

Scanning over the 13 occurrences of 90 01, only one is

a MOV.  Replace the appropriate bytes with a 40 01.

Update the file and quit.



Using your newly patched PBLD-V16, you make a RTP file.

Loading the product into your hex editor, you find that

the first 4 bytes read 4B 2A 40 01.  You also try the

file with that standard issue PATCHDOS from Pocketsoft's

web site.  It recognizes your RTP file and everything

works!  And as with the nag, there is no need to patch

PBLD-DX.EXE.



But we still have to patch PATCHBLD.EXE.  Use the same

technique to find the proper locations to patch.  Another

thing to patch is the Recognition System in the Patch

Apply Programs.  The Recogintion system is patched the

same way, only the telltale instruction is CMP.  Search

for the culprit in the 2 DLL files and their DAT

counterparts -- you'll find them quickly since the CMP

instructions for EE 76 and 90 01 are close to each other.

Also, you will need to patch PBIND.EXE so that it can

recognize a valid RTP file, but you only need to look for

the EE 76 string - that's all it compares.





Fun with Packed Files



.RTPatch has been a complete cracking package - cracking

nags in DOS, Win16 and Win32, as well as that nifty

recognition protection scheme.  But after playing with

your cracked .RTPatch Pro, it won't be long before you

realize you can't make nag-free EZPATCH single file

patches for DOS.  And those are the smallest kind - the

most convenient for distribution.  What are you going to

do about it?  EZPDOS.DAT is a modified PATCHDOS.EXE.

Renaming PATCHDOS.EXE to EZPDOS.DAT and then binding it

doesn't work, so what can you do?  Well, you've come too

far to quit now.  EZPDOS.DAT, like PATCHDOS, is compressed,

which is the exact reason we avoided the hassle of

uncompressing by downloading a different version.  But

this time there is no 'other version' and we're stuck

with this nagged one.  Not for long.  Go check out the

+HCU Project on unpackers and Packed-EXE's -- nothing's

impossible.



Get your copy of Tron 1.3 out.  Even though it's compressed

with an unknown packer, we can still uncompress EZPDOS.DAT

using Tron's universal decompressor.  First, rename

EZPDOS.DAT to EZPDOS.EXE.  Then you can use Tron like this:



tron -u EZPDOS.EXE



EZPDOS has an overlay, so Tron asks if it should remove it.

Answer Yes - EZPDOS still (seems to) runs without it.

After a while you have an unpacked EZPDOS.  Load up

SoftICE 2.x (you're still in DOS, right?) and get rid of

the nag screen like you did all the others.  You'll also

need to look for those Eval recognition bytes and change

them to Licensed bytes.  Now everything works perfect, but

EZPDOS is no longer as slim as it used to be.  You can

re-pack your cracked version with any EXE compressor

(I used PKLITE Shareware) and afterwards rename the file

back to EZPDOS.DAT.

Conclusion



Together we've cracked .RTPatch Pro.  Let's summarize:

        PATCHBLD.EXE       cracked Nag, 25MB limit and Header Write

        PBLD-V16.EXE       cracked Nag and Header Write

        PATCHW32.DLL       cracked Nag and Recognition

        PATCHW.DLL         cracked Nag and Recognition

        EZPNTDLL.DAT       cracked Nag and Recognition

        EZPDLL.DAT         cracked Nag and Recognition

        EZP32DLL.DAT       cracked Nag and Recognition

        PATCHDOS.EXE       replaced with Nagless version from website

        EZPDOS.DAT         Unpacked EXE, cracked Nag and Recognition

        PBIND.EXE          cracked Recognition

 

The fun conclusion to this essay is to gather copies

of the original files in one directory, and copies of

the patched files in another one.  Now you can use

.RTPatch's PATCHBLD to make an RTP file that removes

the protection on itself!  Don't worry about PATCHDOS.EXE

and EZPDOS.DAT.  PATCHBLD can detect that the new versions

are completely different from the originals and will provide

for a file replace in the RTP file - this program is great!



Didn't I say this would be easy?