Reverse Engineering MATLAB 5 Part II: InstallShield Packages Encryption	Packers & Unpackers
19 January 1998	by +Aitor
	Courtesy of Fravia's page of reverse engineering	slightly edited by fravia+
fra_00xx 980119 +Aitor 0100 NA PC	InstallShield Packages Encryption... the sound of these words is so... how can I explain it... tasty? Luscious? Juicy? Well, you understand what I mean, don't you? Our friend +Aitor has already given us his first essay about Matlab: Simple dongle reversing: the 'alien dll date' trick, which was part of our "How to undongle" section. Now he 'deepens' our knowledge of Installshield protections, and therefore this essay will be catalogued inside a new "Objected Oriented Cracking" section if we ever start it... for the moment I have put this among the "packers and unpackers" essays. Enjoy this essay, a little jewel that without much ado teaches you 'on the fly', inter alia, how to code a 'little tool of the trade' to decode the xored-encrypted files that ARE on the CD-ROM you bought (or got) and that you ARE NOT supposed even to see or use...
	There is a crack, a crack in everything That's how the light gets in
Rating	( )Beginner (x)Intermediate ( )Advanced ( )Expert

Second part of this series about reverse engineering MATLAB 5.


Once we have MATLAB 5 running (with or without the dongle ;) we take a
look to the list of installation packages, and something bring us
suspicions about the *real* contents of our CD.  Let's take the
InstallShield (un)compressor and search inside the packages ...


"Hey!" -You'll think- "Hey, that's not possible, mate!" ... 
... because all the *.Z InstallShield packages in the MATLAB 5 CD-ROM are
encrypted ...  therefore ...


No, dear readers: Encryption is indeed one of the most powerful ways to
protect software, but if you're a lazy programmer, even the best
protection techniques will turn stale in your hands, because your mind
won't be merrily pursuing the beauty of a well programmed piece of code,
but it will instead be obsessed by the money you'll earn if you finish
quickly the job ...  You don't believe me? Read the following...

Aurrera with it!


As you have read in the intro, this is our situation:  we have a series of
*.Z files that cannot be decompressed with the InstallShield Compressor ...
... aren't they true InstallShield files?  are they compressed with a new
unknown version of iS?  what the hell is happening here? ... yes, you're
right, they're encrypted !


When a true +reverse engineer finds this kind of protection he thinks "hey,
and what if I try to find the encryption code to rip/reverse the process?"
or even better, taking into consideration the first thing he learnt at
+ORC's School ... "protectionists are stupid!" (OK, some of them are
pretty competent but they are the exception ...).


When you go to your 'Encryption School',  the first lesson (OK, may be the
second :) you are teached is probably the lesson about XOR encryption,
that is,


A XOR B = C
C XOR B = A
simple to understand, simple to code ... and simple to decode !


Just before install every *.Z file, our target decodes it in memory and
stores it in the iS temporal directory ...  we can change to another task
while installing and copy one of the *.Z *decrypted* files from the
temporary dir to a secure place.  Now we have two copies, coded and decoded,
of a package, let's check them ... take your hex editor and compare both
files XORing one with the other (I'll do it with NCD.Z, 'Nonlinear Control
Design Blockset'):


  Encrypted : 0e 47 7e 90 27 1b 19 1c 1d 1a 1b 1c 5f 1a 2d 3e
  Decrypted : 13 5d 65 8c 3a 01 02 00 00 00 00 00 42 00 34 22
              -----------------------------------------------
  XOR Table : 1d 1a 1b 1c 1d 1a 1b 1c 1d 1a 1b 1c 1d 1a 1b 1c


you can't believe your eyes, eh?  Beginning with $1d each byte is XORed
using a single four bytes table, [$1a,$1b,$1c,$1d], until the end of the
file ...  You can try it with any other *.Z file on the CD, you'll get the
same results ...


It's time to take your favourite assembler/compiler and put in practice
your programming knowledge to code a little tool of the trade.  Here you
got ready-to-be-compiled BP7 code to decrypt all the *.Z files found in
the current directory (kontuz!, no error checking at all ...):


{------- cut here --------------- cut here --------------------}

Program Matlab_5__InstallShield_Encrypted_Files_Decoder;

Uses
  DOS;

Type
  TBufferPtr = ^TBuffer;
  TBuffer    = Array [1..32*1024] of Byte;

Var
  EncFile,DecFile        : File;
  BytesRead,BytesWritten : Word;
  Buffer                 : TBufferPtr;
  DirInfo                : SearchRec;
  i                      : Word;
  XorKey                 : Byte;

Begin
  Asm
    mov ax,3
    int 10h
  End;
  WriteLn('+--------------------------------------------------+');
  WriteLn('+  MATLAB 5 InstallShield Encrypted Files Decoder  +');
  WriteLn('+               by Aitor, +HCU 1998                +');
  WriteLn('+--------------------------------------------------+',#13#10);
  FindFirst('*.z',Archive,DirInfo);
  If DosError<>0 Then
    Begin
      WriteLn(' * ERROR: Files not found ...  agur !');
      Halt(1);
    End;
  New(Buffer);
  While DosError=0 Do
    Begin
      Assign(EncFile,DirInfo.Name);
      Assign(DecFile,'deleteme.~$$');
      Reset(EncFile,1);
      ReWrite(DecFile,1);
      XorKey:=29;
      Write(' * Decrypting ',DirInfo.Name, ' ... ');
      Repeat
        BlockRead(EncFile,Buffer^,SizeOf(Buffer^),BytesRead);
        For i:=1 to SizeOf(Buffer^) do
          Begin
            Buffer^[i]:=Buffer^[i] XOR XorKey;
            Inc(XorKey);
            If XorKey>29 Then
              Dec(XorKey,4);
          End;
        BlockWrite(DecFile,Buffer^,BytesRead,BytesWritten);
      Until (BytesRead=0);
      Close(EncFile);
      Close(DecFile);
      Erase(EncFile);
      Rename(DecFile,DirInfo.Name);
      WriteLn('OK !');
      FindNext(DirInfo);
    End;
  Dispose(Buffer);
End.

{------- cut here --------------- cut here --------------------}


With our new decryptor, we're ready to decode and install *all* (note I'm
saying iNSTALL and NOT USE) the crippled modules included in the CD:


   COMM     Z  3.267.584  Communications Toolbox
   FINANCE  Z    755.779  Financial Toolbox
   FUZZY    Z    490.750  Fuzzy Logic Toolbox
   HOSA     Z  1.398.899  Higher-Order Spectral Analysis Toolbox
   IMAGES   Z  3.058.232  Image Processing Toolbox
   LMI      Z    413.974  LMI Control Toolbox
   MUTOOLS  Z    606.983  Mu-Analysis and Synthesis Toolbox
   NNET     Z    346.529  Neural Network Toolbox
   OPTIM    Z     71.431  Optimization Toolbox
   PDE      Z    281.449  Partial Differential Equation Toolbox
   QFT      Z    743.068  QFT Control Design Toolbox
   SPLINES  Z    112.109  Splines Toolbox
   STATS    Z    284.214  Statistics Toolbox
   SYMBOLIC Z  5.636.086  Extended Symbolic Toolbox
   WAVELET  Z  1.363.772  Wavelet Toolbox


and we'll be able to check the contents of files like these:


   HARDWARE Z    207.281
   LICENSE  Z    332.036


with *very interesting material* inside them, but that goes beyond the
purpose and level of this essay ...

Like many other contributors to this pages English is not my mothertongue ...
... sorry for any inconvenience, be patient ;).


Greetings to all the reverse engineers from Euskal Herria (Basque Country) ...
... jotake irabazi arte !


(c) 1998 by +Aitor and the +HCU. All rights reserved.

homepage links search_forms +ORC students' essays academy database
reality cracking how to search javascript wars
tools anonymity academy cocktails antismut CGI-scripts mail_fravia+
Is reverse engineering legal?