|
Subject: Cracking Target: Hex Workshop 2.54 Author: BlackB Date: 1999-04-08 Tools used: W32DSM89, HIEW Difficulty (scale 1-5): 1 Requirements: Basic knowledge of cracking |
|
|
| Wohow! This is my second tut today! ;-) Well yeah, somebody asked for it and had plenty of time....so why not huh? That's about the intro :p |
|
|
| After HIEW this is the best hex editor I've ever seen! Unfortunately the authors of Hex Workshop don't make any new versions anymore (or at least that's what I'm thinking). Their latest version (2.54) dates from half 1997. Okay the protection: only a nag I think. I didn't check what other protection(s) it uses....but who carez anyway...let's crack it :) |
|
|
|
There's an option to fill in a serial, but I hate sniffing out serials, so
I use the dead listing approach (i.e. with w32dsm). So load the .EXE in
w32dsm.
Now when that's done, run the program, fill in a bogus serial and click ok.
After a few seconds the following message appears:
"You have entered an invalid registration number...blablabla". So let's
search for that string in the dead listing.
The first match you encounter should be:
Name: DialogID_0075, # of Controls=003, Caption:"Registration Unsuccessful", ClassName:"" Aha, so the string is pre-defined! If you encounter this in any other program -> don't waste your time seeking the string again, it won't be anywhere in the dead listing anymore. In this case you'll have to search for the string "DialogID_0075". You found it? Okay, when you scroll up a bit you should see this:
-------------------------Start of partial code------------------------------
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C99(C) <- [Aha there is a conditional jump to this procedure!]
|
:00409D18 E8838AFFFF call 004027A0
:00409D1D 89850CFFFFFF mov dword ptr [ebp+FFFFFF0C], eax
:00409D23 8B850CFFFFFF mov eax, dword ptr [ebp+FFFFFF0C]
:00409D29 8B00 mov eax, dword ptr [eax]
:00409D2B 898508FFFFFF mov dword ptr [ebp+FFFFFF08], eax
* Possible Reference to String Resource ID=00001: "Hex Workshop Version 2.54"
|
:00409D31 6A01 push 00000001
:00409D33 8B8508FFFFFF mov eax, dword ptr [ebp+FFFFFF08]
:00409D39 8B8D0CFFFFFF mov ecx, dword ptr [ebp+FFFFFF0C]
:00409D3F FF9094000000 call dword ptr [eax+00000094]
:00409D45 68D0070000 push 000007D0
* Reference To: KERNEL32.Sleep, Ord:0218h <- [This is the delay when you enter the serial]
|
:00409D4A FF1588194900 Call dword ptr [00491988]
:00409D50 E84B8AFFFF call 004027A0
:00409D55 898504FFFFFF mov dword ptr [ebp+FFFFFF04], eax
:00409D5B 8B8504FFFFFF mov eax, dword ptr [ebp+FFFFFF04]
:00409D61 8B00 mov eax, dword ptr [eax]
:00409D63 898500FFFFFF mov dword ptr [ebp+FFFFFF00], eax
:00409D69 6A00 push 00000000
:00409D6B 8B8500FFFFFF mov eax, dword ptr [ebp+FFFFFF00]
:00409D71 8B8D04FFFFFF mov ecx, dword ptr [ebp+FFFFFF04]
:00409D77 FF9094000000 call dword ptr [eax+00000094]
:00409D7D 6A00 push 00000000
:00409D7F 6A00 push 00000000
* Possible Reference to String Resource ID=00001: "Hex Workshop Version 2.54"
|
:00409D81 6A01 push 00000001
* Possible Reference to Dialog: DialogID_0075 <- [This is the string you searched for]
-------------------------End of partial code--------------------------------
When Hex Workshop jumps to this procedure, it already knows you entered the
wrong code, so we'll have to look where the program jumps to this "bad"
procedure. That's not difficult: scroll up 'till you encounter something
like this:
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:xxxxxxxx(C)
In this case, the "xxxxxxxx" is 00409C99. So go to that adress. Scroll up
a bit (you should always scroll up a bit, btw) you should see this:
-------------------------Start of partial code------------------------------
:00409C61 6874D84700 push 0047D874
:00409C66 8D45DC lea eax, dword ptr [ebp-24]
:00409C69 50 push eax
:00409C6A E8810B0300 call 0043A7F0
:00409C6F 83C408 add esp, 00000008
:00409C72 85C0 test eax, eax <-[Validates real serial to yours]
:00409C74 0F8414000000 je 00409C8E <-[Jump to "make unregistered" if wrong serial]
:00409C7A 8D45DC lea eax, dword ptr [ebp-24]
:00409C7D 50 push eax
:00409C7E E83DD70200 call 004373C0
:00409C83 83C404 add esp, 00000004
:00409C86 8945EC mov dword ptr [ebp-14], eax
:00409C89 E907000000 jmp 00409C95
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C74(C)
|
:00409C8E C745EC00000000 mov [ebp-14], 00000000 <-[Make unregistered]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409C89(U)
|
:00409C95 837DEC00 cmp dword ptr [ebp-14], 00000000 <-[Check if unregistered]
:00409C99 0F8479000000 je 00409D18 <-[If unregistered then jump to "bad boy"]
[Btw, this is the jump that
:00409C9F 8B8DFCFEFFFF mov ecx, dword ptr [ebp+FFFFFEFC]
:00409CA5 83C15C add ecx, 0000005C
:00409CA8 E8D37FFFFF call 00401C80
:00409CAD 50 push eax
-------------------------End of partial code--------------------------------
If mov [ebp-14], 00000000 makes Hex Workshop unregistered then probably
mov [ebp-14], 00000001 makes it registered. Okay, now follow my reasoning:
* If the serial is not valid it executes mov [ebp-14], 00000000
* So firstly we have to change that instruction to mov [ebp-14], 00000001
* After that we have to change
:00409C74 je 00409C8E
into
:00409C74 jmp 00409C8E
so the program will ALWAYS jump to our "make registered" instruction!
Make those changes in HIEW. (I hope you know how to do that! If not mail me
and I'll explain you, but you really should know!!)
After you made the changes, Hex Workshop isn't ready yet. There is a double
check that's exactly the same as the one I talked through with you.
You can find it at exactly the same method: search for the "dialogid_0075"
string. If you might not find it (what I extremely doubt), the second
string can be found just below offset 00426399.
Good luck!
After you made all the changes.....start Hex Workshop, enter any serial,
then enter your name and company, and it is registered!
|
|
|
| If u have any questions, comments, etc... mail me on cracking@softhome.net U can also visit my anti-virus page at http://myplace.to.be/blackb Thanks goto: +ORC, tKC, Qapla and all other fantastic tutorial writers who teached me cracking! :-) |