Subject: Cracking
Target: Lockdown 2000 (v3.03)
Author: BlackB
Date: 1999-08-15
Tools used: W32DSM89, SoftICE
Difficulty (scale 1-5): 0
Requirements: Very basic knowledge of cracking

For those who don't know...this must be the lamest protection I have EVER seen!! Even Winzip
is better protected! Let's take a look :-)

10-day trial

Lockdown 's a program that (should) protect your pc against nukes and trojan horses (like BO).
You can use it for 10 days...after that you have to register.

Startup Lockdown (and notice how slow it is). Click on the upper right icon "Unlock" and type
a bogus serial. Click OK and notic the message it gives. Disassemble the .EXE in w32dsm and
look after the string. 

---------------------------------Begin-of-partial-code-----------------------------------------
:004C4BA2 58                      pop eax
:004C4BA3 E894F4F3FF              call 0040403C <- "Calculates" valid serial
:004C4BA8 7504                    jne 004C4BAE  <- "Goodboy" jump
:004C4BAA B301                    mov bl, 01
:004C4BAC EB02                    jmp 004C4BB0 <- "Badboy" jump

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004C4BA8(C)
|
:004C4BAE 33DB                    xor ebx, ebx

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004C4BAC(U)
|
:004C4BB0 84DB                    test bl, bl
:004C4BB2 7523                    jne 004C4BD7
:004C4BB4 6A00                    push 00000000
:004C4BB6 668B0DE44C4C00          mov cx, word ptr [004C4CE4]
:004C4BBD 33D2                    xor edx, edx

* Possible StringData Ref from Code Obj ->"The unlock code you have entered "
                                        ->"is invalid for this machine, please "
                                        ->"re-type the number or contact "
                                        ->"Harbor Telco to receive a new "
                                        ->"registration number."
---------------------------------End-of-partial-code--------------------------------------------

Changing the "jne 004C4BAE" into "jmp 004C4BAE" won't work...let's trace into the 
"call 0040403C"

---------------------------------Begin-of-partial-code------------------------------------------
* Referenced by a CALL at Addresses:
|:0041210B   , :00416D07   , :0041804D   , :0041D59D   , :0041E51C   
|:0042A4CE   , :00431F9E   , :00432029   , :00432C8F   , :00432F04   
|:0043DA13   , :0043DFFD   , :0043E16D   , :0043E2E1   , :00440F89   
|:0044104D   , :00441428   , :004414E7   , :00441942   , :00441B96   
|:00442101   , :004422BF   , :0044FD13   , :0045F23F   , :0045F676   
|:00460C3C   , :0046336B   , :00463D3C   , :004762A8   , :0047668D   
|:0047E88F   , :0047E9D6   , :0047FBAE   , :0047FBC0   , :0048079E   
|:00480A42   , :00480A51   , :00480A60   , :00480A6F   , :00480FF2   
|:00481F3B   , :00488BB7   , :0048AEBB   , :0048B712   , :0048B776   
|:0048B78E   , :0048B8A3   , :004A33F9   , :004A4722   , :004A52A2   
|:004A5D12   , :004A620C   , :004A68A9   , :004A8382   , :004A8B24   
|:004ABD83   , :004AC29F   , :004ACA0F   , :004ACCD4   , :004ACF05   
|:004AD0B5   , :004AD0E0   , :004AD0FC   , :004AD149   , :004AD286   
|:004AD3C2   , :004B05CD   , :004B06D1   , :004B0901   , :004B30C6   
|:004B30D5   , :004B30E4   , :004B30F3   , :004B3421   , :004B3861   
|:004B3993   , :004B64A0   , :004B6529   , :004B6904   , :004B69C6   
|:004B69D8   , :004B6A9F   , :004B6AC7   , :004B6B6F   , :004B6D34   
|:004B6D53   , :004B6D7D   , :004B6D9C   , :004B71D0   , :004B780E   
|:004B7880   , :004B85C7   , :004B8BDB   , :004B8C18   , :004BC159   
|:004BC9AB   , :004BD23A   , :004BD40D   , :004BE3A9   , :004BEC7D   
|:004BECFB   , :004C0E48   , :004C0E97   , :004C156C   , :004C158D   
|:004C3AD2   , :004C3C6D   , :004C4BA3   , :004C54A1   , :004C5A0A   
|:004C5E1E   , :004C5E58   , :004C5ECA   , :004C5F04   , :004C5F76   
|:004C5FB0   , :004C6022   , :004C605C   , :004C60C9   , :004C6125   
|:004C6181   , :004C61DD   , :004C659E   , :004C65D0   , :004C99A2   
|:004C9E90   , :004CA568   , :004CAF3D   , :004CAF72   , :004CB762   
|:004CBA39   , :004CBAF2   , :004CBB18   
|
:0040403C 53                      push ebx
:0040403D 56                      push esi
:0040403E 57                      push edi
:0040403F 89C6                    mov esi, eax <- Move real serial in esi
:00404041 89D7                    mov edi, edx <- Move your serial in edi
:00404043 39D0                    cmp eax, edx <- Compare them
:00404045 0F848F000000            je 004040DA  <- If they're equal...jump to "goodboy"
:0040404B 85F6                    test esi, esi
:0040404D 7468                    je 004040B7
:0040404F 85FF                    test edi, edi
:00404051 746B                    je 004040BE
:00404053 8B46FC                  mov eax, dword ptr [esi-04]
:00404056 8B57FC                  mov edx, dword ptr [edi-04]
:00404059 29D0                    sub eax, edx
:0040405B 7702                    ja 0040405F
:0040405D 01C2                    add edx, eax
---------------------------------End-of-partial-code--------------------------------------------

Okay...ADMIT...this "protection" is REALLY FUCKED UP! ;-) 
Note: I don't remember quite well if the real serial is stored in esi or edi...but that's easy
for you to find out.
Now there are 2 possibilities to crack it:
   1. Use Softice to get a valid serial
   2. Use HIEW to patch the program

If you decide to use method 1 then note that the serial is different on very computer!

############
# Method 1 #
############

1. Write down 00404043.
2. Fire SoftICE symbol loader
3. Load Lockdown2000.exe and execute it
4. When Sice pops, set a breakpoint on 00404043 (bpx 00404043)
5. Press CTRL-D (leave sice)
6. Enter a bogus serial in the prog and press OK
7. Sice popsup at line 00404043 39D0 cmp eax, edx
8. Do a "d eax" in Sice to get the real serial (it could also be stored in edx! find out urself)
9. Clear breakpoint (bc *) and exit sice (CTRL-D)
10.Now type in the serial you just found....prog registered :-)

############
# Method 2 #
############
Important note: I did not test this method because I can't manage to unregister the prog!

1. In w32dsm get the offset address of :00404043 39D0 cmp eax, edx
2. Startup you favorite hex editor
3. Open the .EXE and change the "cmp eax, edx" into "cmp eax, eax" or "cmp edx, edx"
4. Save and exit

With this method, the program should always be registered on every computer...let me know if
it doesn't!!

That's it for now :) and btw, just DON'T use this program...it really sux!
If u wanna get in contact with me...that's possible...you can mail me at cracking@softhome.net
If you want to reach me very fast then you can contact me on IRC (EFnet). My nick is BlackB.
But PLEAZE!! Don't bother me with stupid questions!!

Special greets goto: Magic Mike, sn00pee, R!sc and SiGMA (order not important)

C.U. my fellow crackerz!

BlackB