Cracking HEdit 2.0
(using wdasm as a debugger)
by x86
(19 August 1997, slightly edited by Fravia)
With an addition by itzMagik1, 4 January 1998
Cracking HEdit version 2.1.11
Courtesy of Fravia's page
of reverse engineering
Well, this essay is interesting, for me, because
it's the first time that somebody explains how to use Urbanik's disassembler as
a "quick and dirty" debugger tool... now, you see, I mostly disassemble files in
order to reverse engineer them, and use winice only if really compelled (why
burn your eyes on a screen, as +ORC said, when you can crack relaxed in the shadows of your
garden, sipping a good cocktail in fresh air?) so the idea of "remaining" inside
wdasm to try a couple of probes is not bad at all...
Besides, HEdit is an
hexeditor, and for hexeditors the chase is always open!
Yet I'm not happy that
an +HCUker "leaves" a crack part to others... PROFESSIONAL PRIDE! If you're a
+cracker (or if you want to be one) you should finish your cracks! Therefore I
expect an addition to this essay FROM x86 (and nobody else :-)
ADDITION: 20 August 1997. ...and I got it! Good x86, right so +cracker! You'll find it
as second part of this essay!
There is also an addition by itzMagik1, 4 January 1998
Cracking HEdit version 2.1.11
Cracking HEdit 2.0
By x86
HEdit 2.0 can be found at:
ftp://ftp.cdrom.com/.23/simtelnet/win95/editor/hedit2.zip
This is my first essay, and I'm still a bit of a beginner, so bear with
me. I decided to do this crack using AS A DEBUGGER wdasm 8.9
instead of SoftIce, simply for a change of pace, and to show how the code
patch utility can be quite a time saver for trying out cracks on the fly.
This protection scheme is really stupid, given the amount of code dedicated
to the registration routines (more on that later).
I started HEdit to get an idea of what I was dealing with. No opening
nag screen, that's nice. Close it down, still no nag screen.
Hmmm, what is there to crack?
Set my clock ahead 1 month, and bingo. A nice message telling me my
14 day trial had expired.
- A quick aside here-
I started off trying to crack the registration functions of the program,
looking for the typical 'cmp good, bad' and 'test eax, eax'.
To make a long story short, this program goes through tons of convoluted
checks all over the place, and after about an hour, I decided screw it.
I'll leave that to one of our more experienced crackers, and besides, once
you crack the time-check mechanism, you're in home free.
So, now we look for the call to Kernel32.GetLocalTime (see, I have
learned something!). There is only one and the code around it looks like
this:
* Reference To: KERNEL32.GetLocalTime, Ord:00E2h
|
:00409CFC FF1524A94400 Call dword ptr [0044A924]
:00409D02 8D4C2404 lea ecx, dword ptr [esp+04]
:00409D06 51 push ecx
* Reference To: KERNEL32.GetSystemTime, Ord:0121h
|
:00409D07 FF151CA94400 Call dword ptr [0044A91C]
:00409D0D 668B0DDA7D4400 mov cx, word ptr [00447DDA]
:00409D14 66394C240E cmp word ptr [esp+0E], cx
:00409D19 753C jne 00409D57
:00409D1B 66A1D87D4400 mov ax, word ptr [00447DD8]
:00409D21 663944240C cmp word ptr [esp+0C], ax
:00409D26 752F jne 00409D57
:00409D28 66A1D67D4400 mov ax, word ptr [00447DD6]
:00409D2E 663944240A cmp word ptr [esp+0A], ax
:00409D33 7522 jne 00409D57
:00409D35 66A1D27D4400 mov ax, word ptr [00447DD2]
:00409D3B 6639442406 cmp word ptr [esp+06], ax
:00409D40 7515 jne 00409D57
:00409D42 66A1D07D4400 mov ax, word ptr [00447DD0]
:00409D48 6639442404 cmp word ptr [esp+04], ax
:00409D4D 7508 jne 00409D57
:00409D4F 8B15C87D4400 mov edx, dword ptr [00447DC8]
:00409D55 EB46 jmp 00409D9D
By tracing where this code goes, we eventually get a 'ret' and end up
here:
* Reference To: ADVAPI32.RegQueryValueExA, Ord:00E1h
|
:00403D55 FF154CA74400 Call dword ptr [0044A74C]
:00403D5B 85C0 test eax, eax
:00403D5D 0F85DE000000 jne 00403E41
:00403D63 83EC04 sub esp, 00000004
:00403D66 8965D0 mov dword ptr [ebp-30], esp
:00403D69 FF75EC push [ebp-14]
:00403D6C 8B4DD0 mov ecx, dword ptr [ebp-30]
:00403D6F E8C5020000 call 00404039
:00403D74 8D45E0 lea eax, dword ptr [ebp-20]
:00403D77 8D4DD4 lea ecx, dword ptr [ebp-2C]
:00403D7A 50 push eax
:00403D7B 51 push ecx
:00403D7C E826320100 call 00416FA7
:00403D81 8BC8 mov ecx, eax
:00403D83 E8BC020000 call 00404044 ***
And this is the SECOND part to this session, that x86 sent me one day
later (see: constructive critics works! :-)
Fravia -
'Professional pride', ouch! Got me where it hurts! :)
Anyway, here is the addition to my previous essay. It's now fully cracked,
and (hopefully!) no lame copouts.
Cracking HEdit 2.0 Part II
By x86
Ok, Fravia had a good point, I should've finished what I started! I am so
ashamed! Well, rest assured it won't happen again.
Ok, on to the crack. This addendum to my original essay targets the
registration functions of HEdit 2.0 and will allow you to enter any
name/number you want and be fully registered.
I should point out that this crack actually supercedes my previous one,
in that this crack will automatically take care of the expiration problem
since the program will actually think you entered a valid registration
number.
There are a couple of different approaches to consider. You can try to
figure out how the program decides if you are registered (what I originally
tried to do... don't bother) or you can attack the registration key
encrypt/decrypt section directly, which is what we will do!
Once again, I'll be using Wdasm as a debugger to try my patches on the fly,
so load up HEdit and follow along.
To start, I tried to find out what happened when I entered an invalid
registration name/number.
I got the message, "The user name and/or registration number you entered
are incorrect."
Ok, Wdasm has a string reference listing of all the strings in the data
section, so let's see if we can find a match. Sure enough, and there
are 3 occurrences of it.
Let's set breakpoints on each one, and run the program again.
Enter a name and number into the registration box (Help/About/Register)
and Wdasm will break here:
* String: "The user name and/or registration number you entered are inc"
|
:00405099 6888000000 push 00000088
:0040509E E8BCFC0100 call 00424D5F ? Display bad msg
:004050A3 EB14 jmp 004050B9 ? Bye bye, try again
We know something is triggering this message so let's find it.
We don't need to look far.
Right above lies this code snippet:
:0040506B 56 push esi
:0040506C 57 push edi
:0040506D 8BF1 mov esi, ecx
:0040506F E808AE0200 call 0042FE7C
:00405074 8B7804 mov edi, dword ptr [eax+04]
:00405077 6A01 push 00000001
:00405079 8BCE mov ecx, esi
:0040507B E870890100 call 0041D9F0
:00405080 85C0 test eax, eax
:00405082 7435 je 004050B9
:00405084 FF7660 push [esi+60] ? The number you entered
:00405087 FF765C push [esi+5C] ? The name you entered
:0040508A 8BCF mov ecx, edi
:0040508C E82DEFFFFF call 00403FBE ? Main reg. check routine!
:00405091 85C0 test eax, eax ? eax != 0 means `Go boy'!
:00405093 7510 jne 004050A5
:00405095 6AFF push FFFFFFFF ? Begin beggar off routine.
:00405097 6A00 push 00000000
Now, at this point, you might be tempted to say, "Hey, we can just change
the jne instruction to a jmp, and away we go!" Well, go ahead and try it,
it won't work.
This is why my previous approach was such a lame way to go.
There are other checks in this program besides this one, so what we need
to do is to crack the main registration checking routine.
Let's have a look.
* Referenced by a CALL at Addresses:00403A3D, :00403CDE, :00403E07, :0040508C
|
:00403FBE 55 push ebp
:00403FBF 8BEC mov ebp, esp
:00403FC1 81EC00010000 sub esp, 00000100
:00403FC7 6800010000 push 00000100
:00403FCC 8D8D00FFFFFF lea ecx, dword ptr [ebp+FFFFFF00]
:00403FD2 FF7508 push [ebp+08]
:00403FD5 51 push ecx
:00403FD6 E8054F0000 call 00408EE0
:00403FDB 83C40C add esp, 0000000C
:00403FDE 8D8D00FFFFFF lea ecx, dword ptr [ebp+FFFFFF00]
:00403FE4 51 push ecx
:00403FE5 E856200100 call 00416040
:00403FEA 83C404 add esp, 00000004
:00403FED B904000000 mov ecx, 00000004
* Referenced by a Jump at Address:00404015
|
:00403FF2 8BC1 mov eax, ecx
:00403FF4 41 inc ecx
:00403FF5 99 cdq
:00403FF6 33C2 xor eax, edx
:00403FF8 2BC2 sub eax, edx
:00403FFA 83E003 and eax, 00000003
:00403FFD 33C2 xor eax, edx
:00403FFF 2BC2 sub eax, edx
:00404001 8A940DFFFEFFFF mov dl, byte ptr [ebp+ecx-00000101]
:00404008 30940500FFFFFF xor byte ptr [ebp+eax-00000100], dl
:0040400F 81F900010000 cmp ecx, 00000100
:00404015 7CDB jl 00403FF2
:00404017 8B8500FFFFFF mov eax, dword ptr [ebp+FFFFFF00]
:0040401D 85C0 test eax, eax
:0040401F 7D02 jge 00404023
:00404021 F7D8 neg eax
* Referenced by a Jump at Address:0040401F
|
:00404023 39450C cmp dword ptr [ebp+0C], eax ***Here! [ebp+0C]
:00404026 7509 jne 00404031 is what the num.
:00404028 85C0 test eax, eax should be and eax
:0040402A B801000000 mov eax, 00000001 is what you
:0040402F 7502 jne 00404033 entered.
* Referenced by a Jump at Address:00404026
|
:00404031 33C0 xor eax, eax
* Referenced by a Jump at Address:0040402F
|
:00404033 8BE5 mov esp, ebp
:00404035 5D pop ebp
:00404036 C20800 ret 0008
Ok, so here is what happens. If your number doesn't match what is
expected, the jump to xor eax, eax is executed (remember, the program
expects a non-zero return in eax if the registration number is correct).
If it does match and isn't zero, 1 gets put into eax and we return and
all is well.
So, what we need to do is skip the bad jump if our numbers don't match.
Let's test it to make sure.
Clear all of the breakpoints and set a new one at 00404026 and run it,
and enter something for the name/number. When Wdasm breaks, use the code
patch utility to change the `jne 00404031' to `nop, nop'.
Apply the patch and hit `run'. Presto! You are regged!
Summary of the crack:
Offset (3426h)
Change 75 09
To 90 90
You can use this crack rather than my previous one.
Once again, sorry for my temporary lameness.
I'm going to give myself 0x28 lashes and send myself to
bed with no dessert! Until next time-
x86
Here is an addition to this essay by
itzMagik1, added on 4 Jnuary 1998
Cracking HEdit version 2.1.11
Written by itzMagik1 on December 30, 1997.
Contact itzMagik1(at)aol(point)com for questions/comments.
Introduction: This is my first crack for the +HCU.
Granted it's not very hard, but everyone has to start somewhere.
The crack for HEdit version 2.1.11 was relatively simple thanks
to x861's earlier essay, Cracking HEdit 2.0, that you can read
above.
Tools Required: Windows Disassembler 8.x
A hex editor (why not use HEdit 2.1.11)
SoftIce (or WDASM for debugging)
Program History: HEdit 2.1.11 uses the same protection scheme as it's previous
version. I've never used anything before that, so I can't describe it's
scheme.
Let's get right to the crack. Start up HEdit, then click Help, then about
HEdit. Notice the button that says register. I love programs that have this
button: they are so easy to crack. Click the button. You'll get another dialog
with a place for your name and registration number. Type your name in the
first box and a 1 in the second. Click OK. You'll see some long, drawn out
error message about how your "registration" number isn't correct. That's our
key.
Now Run hedit.exe through WDASM. I think it's a good disassembler, but it's
not the best debugger, so I'll use SoftIce. Search for the word
"registration." You should find it 3 times. I set breakpoints on each one in
SoftIce (BPX 004017CF, 00402239, 004353DA). Now load it into SoftIce. When
SoftIce breaks, you'll land at 00402239. Here's what you'll see:
:00402239 push 00000088
:0040223E call 00427930
In WDASM, that corresponds to:
* Referenced by Jump at Address:0040221A(C)
:00402235 6AFF push FFFFFFFF
:00402237 6A00 push 00000000
* Possible Reference to "The user name....."
:00402239 6888000000 push 00000088
:0040223E E8ED560200 call 00427930 - display bad message
Let's see where this is getting called from. Look up a few lines and you'll
see:
:00402209 8B4660 mov eax, dword ptr [esi+60] - The number you entered
:0040220C 8B4E5C mov ecx, dword ptr [esi+5c] - The name you entered
:0040220F 50 push eax
:00402210 51 push ecx
:00402211 8BCF mov ecx, edi
:00402213 E878170000 call 00403990 - Call the registration check routine
:00402218 85C0 test eax, eax - If eax != 0, you're good
:0040221A 7419 je 00402235
As with the previous HEdit, it does the same thing. How do we fix this?
Simple.
The main registration routine is exactly the same as in the previous version.
All we have to do is search for the block of code that checks what you entered
versus what the number should be. Lucky for us, x861 has already provided it
for us. Here's the code:
* Referenced by Jump at Address:004039ED(C)
:004039F1 3B84240C010000 cmp eax, dword ptr [esp+0000010C] - What you entered
vs the "correct" number
:004039F8 7513 jne 00403A0D - You're gone
:004039FA 85C0 test eax, eax
:004039FC 740F je 00403A0D - You're good
:004039FE B801000000 mov eax, 00000001
:00403A03 5B pop ebx
:00403A04 81C400010000 add esp, 00000100
:00403A0A C20800 ret 0008
* Referenced by Jump at Address 004039F8(C), :004039FC(C)
:00403A0D 33C0 xor eax, eax
:00403A0F 5B pop ebx
:00403A10 81C400010000 add esp, 00000100
:00403A16 C20800 ret 0008
What happened in HEdit 2.0 also happens here. If you're number isn't
"correct," the jump to xor eax, eax is executed and you're done. If it does
match, 1 gets put into eax and you're registered. So we can change the jne to
nop. Here's the crack:
At Offset 0x00002DF8
Change 75 13
To 90 90
Once changed, you can use any name and registration number you want.
HEdit 2.1.11 can be downloaded from http://www.yurisw.com/hedit/download.htm.
Hope you enjoyed this easy crack. Thanks to x861 for his previous essay.
Hopefully you'll see more of my essays in the future. I'll aim for something a
little more difficult next time.
itzMagik1
(c) itzMagik1 1998. All rights reversed
(c) x86 1997. All rights reversed
You are deep inside fravia's page of reverse engineering,
choose your way out:
Back to project 1 (tools of the trade)
homepage
links
anonymity
+ORC
students' essays
academy database
tools
cocktails
antismut CGI-scripts
search_forms
mail_fravia+
Is reverse engineering legal?