Log in

View Full Version : Am kinda back and stuck!!!

ra_in
September 26th, 2006, 14:23
Hi fellow reversers,

Having been out of reversing (and computers in general - was in a different industry, different world - almost a parallel universe ;-) for more than a couple of years I am back, albeit with a different nom de plume. The forum won't allow me to login with the old handle which is just as well (I guess its best to let go of the past and do a fresh start)

Great to know that RCE Forum is still going strong and Tsehp/Woodmann are continuing to provide kindof safe haven to the RCE sites and helping reversers. Good to see that Kayaker is still active. I wasn't able to track any recent post of my old friend ferret though

Coming back to computers what do I find - things have changed, there are things that I have forgotten etc etc.

Bascially it all started when I was trying to crack something called <program name removed>. Now this target apparently written in .Net employs "ActivationID+HardwareID+ActivationCode protection". One gets an ActivationID from the company on registration which when input causes the HardwareID to be displayed and when these two are sent to the site the site provides the ActivationCode which unlocks the full functionality.

There's an activation.dll in the directory which apparently does the activation, but no exports in that file.

Now I don't think I have dealt with this kindof server activation in the past (which is too distant for me . Would really appreciate any pointers as to how to proceed...

btw I am on an Windows XP/2003 system, which tools would I need for this. I seem to be having si405/wdasm/ida 3.x lying around. What else is needed?

(Necessity seems to be the mother of learning for me...:devil

TIA,
RA IN
fr33ke
September 26th, 2006, 15:10
Try Reflector: if there is a CLI header it can decompile the .NET program. See http://www.aisto.com/roeder/dotnet/.

PS: Remove the program name before a mod sees it
Kayaker
September 26th, 2006, 15:40
Welcome back(?) ra_in. Oh now that's just teasing, waxing nostalgic about the old days and not giving your nick!

Alas, ferret doesn't post here anymore (afaik), neither do many others unless they too went to ground and reemerged under a different moniker. The rest of us stragglers are lifers and couldn't leave if we tried

Things are still as strong as ever here, lots of good reversers, lots of good programmers. After you read a few posts you may get the sense things aren't quite as "open" as they used to be in terms of mentioning target names and posting target specific code. Basically the idea is not to allow the script kiddies (or warez whores as Woodmann likes to call them) from taking information from posts and using it to make cheap cracks, etc. Just keep this in mind when posting, talk about what you want, but try to keep it "somewhat" generic and all will be OK.

Anyway, it's always nice to see old friends coming back. Btw, I can probably merge your old posts with your new ones and/or restore your old-school nickname if you wish, but that's entirely up to you. Have fun!

Cheers,
Kayaker
LLXX
September 26th, 2006, 21:49
Quote:
One gets an ActivationID from the company on registration which when input causes the HardwareID to be displayed and when these two are sent to the site the site provides the ActivationCode which unlocks the full functionality
My first try would be to find the critical jump and force it (easiest patch), but I don't think a keygen is out of the question, especially since all the code is present in your target and the verification (of the activation code) is done clientside.
Aimless
September 27th, 2006, 19:39
And maybe you should read the FAQ as no program names are allowed.

Sorry for sounding so rude, I thought that its only fair if Newbies are criticised for the "lack of reading faq and therefore no program name", then so should the others, experienced or not.

Peace.

Have Phun
ra_in
September 30th, 2006, 18:32
First off, Aimless and fr33ke - point taken. I thought I knew the rules here and I was wrong. Thanks for correcting me.
Kayaker, good to see you old pal. What are you upto these days? I guess I'll pass-off your offer for now. For all practical purposes I am a newbie and perhaps will always be.

Coming back to this stupid 'rot-net' app that I am working on, I made some headway thanks to Reflector (and trusty old IDA) (thx fr33ke for the pointer). btw this reminds me of the days of Jad and java decompilation. I managed to patch the registration routine so I can get the freaking app to register. However while generating output which happens to be recovered data from logs after 'stuff' is deleted, i assume again a validity check is made, for the app continues to proclaim itself as a trial version. Looked around for shortcuts and found a function "getcodeisvalid" which looks thus:
(function names changed - Moderators to delete/edit code/post in case of violation)
Code:
.method public specialname virtual instance bool marshal() getcodeisvalid() cil managed

{

      .maxstack 3

      L_0000: ldarg.0 

      L_0001: ldfld int8 modopt([Microsoft.VisualC]Microsoft.VisualC.NoSignSpecifiedModifier) modopt([Microsoft.VisualC]Microsoft.VisualC.IsConstModifier)* xxxx.xxxx.Registration.Manager::b

      L_0006: ldc.i4 20060706

      L_000b: ldarg.0 

      L_000c: ldfld method unmanaged stdcall bool modopt([mscorlib]System.Runtime.CompilerServices.CallConvStdcall) *(int8 modopt([Microsoft.VisualC]Microsoft.VisualC.NoSignSpecifiedModifier) modopt([Microsoft.VisualC]Microsoft.VisualC.IsConstModifier)*, int32) xxxx.xxxx.Registration.Manager::h

      L_0011: calli method unmanaged stdcall bool modopt([mscorlib]System.Runtime.CompilerServices.CallConvStdcall) *(int8 modopt([Microsoft.VisualC]Microsoft.VisualC.NoSignSpecifiedModifier) modopt([Microsoft.VisualC]Microsoft.VisualC.IsConstModifier)*, int32)

      L_0016: ret 

}


of course this should return True (ok maybe false). How can I force it to? I can nop most of the code and return true, but I might have to adjust the stack. How to determine how much? What does .maxstack mean? How to resolve those long ldfld/calli calls (which file/function do they resolve to etc.)

Finally, any debuggers out there customized for .net? Would appreciate any help!

au revoir,
RA_IN