Adaptec DirectCD Upgrade - IDA for beginners
(Software updates: 'Previous version' checks)

by Zeezee
(5 November 1997, slightly edited by fravia+)

---

Courtesy of fravia's page of reverse engineering


IDA is an Official +HCU tool

Here another submission of mine. I don't know exactly into what category it 

should fall, maybe "Most Stupid Protection"? It is somewhat similar to my 

'PDFWtirer' essay of last week - you get fully functional upgrade directly 

from the authors for free (after some work of course).

On the Web you find many software updates which can be installed

on top of the previous version or after giving serial# of the previous version.

The goal of this essay is to give some light to previous version checks.



Our today's target will be Adaptec DirectCD Upgrade version 1.01b.

For most of us the quality / functionality of the target is not important, but

for them thinking of trying it, a short description follows.



You must have a UDF-capable CD-Recorder and Windoze 95 to use it.



DirectCD is a software enabling you to use your CD-Recorder just like another

drive in the system. if you don't have a CD-R or CD-RW drive this software is

completely useless to you (except as cracking target). Until now, CD-s

were written in single- or multisession mode making practically impossible to

use them as everyday backup devices. Now UDF format arrived and Adaptec started

to play with it. DirectCD works under Windoze 95 only, and is of course (like

all commercial stuff) full of bugs. Neverthless I'm using it, however I'm far

from recommending it to anyone. Simply I've not found anything working better

until now.

Back to cracking it.



Tools needed and tools not needed:



DIRECTUP.EXE from adaptec (552k): our target

IDA     - of course, you may use the freeware version ida37fw.zip, but the 

          cracked (Quined :-) IDA37 is much better.

HIEW    - no, we do cracking _without_ patching here!

SoftICE - no (I have nothing against it, but this protection scheme is too 

          stupid for it)

optionally regmon and filemon (from ntinternals)

cup of coffee / cocktail / anything you like for the 'analyzing' phase of IDA 

(3 mins)



You must follow this lesson with IDA switched on the target, there are no 

listings below!



---These steps are informational only and not necessary in the cracking process

You can start the .EXE you downloaded, go until it says that previous version

isn't found and exit. Simply in order to know, what the program tries to do.

You can start regmon just to see what the program needs from registry.

You can start filemon just to see that what we discover later.

You can even have SoftICE up and running but i don't see any usage for it here.

---These steps end



Back to our target.



Run IDAW (or IDAX, whatever you use) DIRECTUP.EXE

 Remember to click "Load Resources" on starting dialog. Do it always with

 Windoze programs. Here this isn't necessary, but with most other programs

 resources are needed. You may edit its cfg file to let IDA load 

 resources always.



Let IDA do its work. Drink what you prepared before our session and look how

wonderful IDA does it. Green READY in upper right corner? - ok, let's go on.



Menu Options/Cross-References. All checkboxes should be on, and the number 

of xrefs displayed should be set to 100 just to be sure you don't miss 

anything. I have this in my cfg.



So, first we check for some interesting strings, say "install"

Alt-B and choose "nstall"  (Case sensitive checkbox on, otherwise very sloooow 

search).

Use "nstall", not "install": we don't know the case of 'i'.

We got 004198A4. Read this very informative message. But poor istaller did not

output it to our window during install. Look at text above and below. See - all

of them are referenced from the code! 



Let's try. Position cursor on xref to found string, press Enter.

Yes, it's pushed and some function called. Cursor on address of this fun, Enter.

OH, how many references, it must be very, very often used, let's see what's

inside.

The names will be discovered by IDA37 automagically!



call wsprintf

...

call __splitpath

...

call __strupr

...

call WriteFile



It's kinda logfile, isn't it?



We found where hFile is stored, see before WriteFile there is dword_41A1D4

referenced. Go to it. Yes - once written (check it, in sub_403E40 it's written

after CreateFile), several times read.



What's the file name? Try to find it or (simpler) run the installer, switch

to Explorer when it's displaying one of the windows and look into \temp dir.

This file will disappear after setup finishes, but we may undelete it using

DOS or what you have. BTW it's very informative, however not essential for our

further cracking.



We name proc at 004040D0 say, WriteLog. (press n when cursor is on address).

See how the target itself (and IDA of course) help us cracking!

 

Esc and we are back with our WriteLog call with "Unable to find Target Dir..."

Seems to be the last thing done in this procedure.



See what's checked in this procedure. Two PgUp-s above and we discover that

"Shellex.dll does not exist" is written to the log,

a bit above: 

"DirectCD.exe does not exist", 

we look upwards again finding what's written to the log.

We renamed the proc so we see immediately yellow-on-blue where it is called.



When you reach start of the proc at 401200 you may surely rename it to

"CheckPrevious" or similar. It's called from WinMain (2 times), Got it?



OK, now is the time to do detailed inspection about what setup the target 

expects to find on your disk... with a Little Help From Our Friends 

(from adaptec).



1. 00401290

  In registry Soft..\Micr..\Wind..\CurVer..\UnInstall\DirectCD10 you must have

  UninstallString set to something. See in other appz how it should look like.

  Say, you want to install in C:\DCD, so it should be like this:

  UninstallString=C:\W95\uninst.exe -f"C:\DCD\DeIsL1.isu"

  Of course for 'W95' substitute your own windoze dir.



2. 004013E9

  In the selected dir should exist a file DIRECTCD.EXE

  Contents and size of this file seem to be unimportant.

  Copy anything you like to a fake file DIRECTCD.EXE in this dir.



3. 00401484

  Like in 2. there should be also a SHELLEX.DLL. Copy anything to it.



You may look at the disassembled file. The more you play with IDA, the more 

you will like it. The whole analysis, including library calls is done. All 

xrefs are correct: bye bye wdasm.



Run setup again. You have DirectCD fresh and hot. Uninstall it when you don't

want to use it. When you have some "unwanted" CD-Rs you may have to find the

reference to "llegal" and patch what's necessary. The logfile helps you alot.



After doing it all, you may want to look at unerased logfile or check some 

references to WriteLog.



Exercise:

Get Easy CD Pro Update (EASY2UP.EXE), and do it again. There is one

more check between the 'EXE' and the 'DLL' presence checks. Find it. 

Crack it.

Hint: Run it first to get EASY2CUP.EXE (with a C inside the name)- that 

it's the real installer.



Conclusion.

The programmers at adaptec are nice. More than nice. They simply help crackers.

We know exactly what is expected, what is wrong, simply everything.

I don't want to repeat myself about IDA. You've seen 1% of IDA power in this

essayjust following it. The remaining 99% are up to you.



IDA weaknesses: just to know about them.

- hard-to-find info in docs, but there is everything, you must just find it.

- don't know what to do with loaded resources. They are not decoded or I don't

  know how to do it. Someone helps?



greets as usual

zeezee (zee_zee@hotmail.com)

      

homepage links anonymity +ORC students' essays academy database
tools cocktails antismut CGI-scripts search_forms mail_fravia
Is reverse engineering legal?