Cubase -Dongle protection cracking
The main tricks
by Xoanon
(16 May 1997, slightly edited by Fravia)
Courtesy of Fravia's page of reverse engineering
Well... dongle protection cracking, old
crackers' songs sing it, old crackers paintings idealize it... let's begin to
do it, let's show the world how useless even hardware protections are. This project
has been allowed thank to this first sound contribution from Xoanon
I may remark that at the end Xoanon wrote "First phase"... Hey, Xoanon... dov'Ë la
SECONDA fase?
Cubase 3.0 UNDONGLED!
courtesy of +XoanoN/PiNNACLE 1997
Well, i have seen some of my previous works published by the +HCU.
And for me this is already enough... Wow! To be on "the" site together
with the "Gotha" of cracking!!! So i decided to start working on a more
serious project, a cracking subsector that only REAL +crackers can face:
DONGLES!
Eh eh.... well, i have seen that the +HCU needs something about dongles, so
why should I not try? Let's see....
Prologue:
----------------------------------------------------------------------------
First of all, i decided to try this donglecrack 'coz i don't know of ANY
version of Cubase 3.0 working (i mean REAL 100% cracked). Maybe there are
newer versions out (i think 3.05 or more), but i'm not sure if are cracked
well, coz i haven't tried them.
And, the reason of this is quite simple: many crackers tend to not even
trying out the programs once they THINK they've cracked them, and since
Cubase has a funny trick (to let you think you've cracked it after less
than 2 minutes of debugging... you got it?) I think it is worth explaining
a little its protection schemes. By the way, i tried cracking it 1 year
ago and did the same error.
In more understandable terms, simply NOPPING a JNZ lets you bypass the
initial donglecheck, so cubase "runs" somehow. But try working more than
10 minutes (or even less)... try creating new tracks, by clicking 4 or
5 times on the right window... try choosing "Score" from the menu....
TRY ANYTHING!!! It will soon crash with a "General Protection Failure"
error report...
Some donglecracking infos you may need:
--------------------------------------------------------------
Since dongles are a relatively "strong" way to protect a program (a dongle
can contain locations where the program needs to jump, etc...) sometimes
without them it's impossible to crack such protections... I mean, in some
hard cases (i.e. when the locations of the jmps are stored *directly*
inside the dongle) you'll need ABSOLUTELY the dongle, or you can't do
anything... the program will not run.
In this case (and in other ones as well) first try to "emulate" the dongle,
if you understand how it works. If you can't, then try a BRUTE FORCE
approach (read my tutorial) to fool the program (as i did with Cubase).
This is the way to proceed in order to "bruteforcing" a dongle:
1) Write down the locations where the program crashes/does not run
2) Trace back and try to locate the switches (jumps) which jump to these
locations
3) Be sure these locations aren't used in other part of the program as well
Let's start!!!
-----------------------------------------------------------------------------
Ok, are u ready with your Martini Vodka and/or cigarettes AND Softice???
Good...... let's begin eradicating the initial donglecheck!
(you could also try to emulate the dongle by setting BPIO -h on printer
ports such as 0378/0379/037a etc... you will land in the CUBASE.VXD...
and believe me... it's better to try another approach!)
Well, you run Cubase and it popsup with the classic "Plug the dongle,idiot"
screen.... Ah ah ah!! Simply rerun it, Ctrl-D before the nag appears, hit F12
more than once to trace back calls (p ret is for sure one of the best
SoftICE's functions i think, without it some of the hard cracks couldn't be
done) and you'll land in the CUBASE30CM module. Step step and step until
you reach this code (you might need to set some temporaneus BPX to get rid
of cycles_loops, but you will figure out yourself where and how... otherwise
i would spend a whole day writing this tutorial!):
*Initial Check
0013.3C36 6A00 push 0000
0013.3C38 6A00 push 0000
0013.3C3A 56 push si
0013.3C3B 6A3F push 003F
0013.3C3D 6A00 push 0000
0013.3C3F 90 nop
0013.3C40 0E push cs
0013.3C41 E8A924 call 60ED <TRACING this call you will see how the dongle operates, you'll reach the VXD too. but you better don't consider it! Let's BRUTEFORCE! 0013.3C44 83C40A add sp, 000A 0013.3C47 8BF8 mov di, ax 0013.3C49 8BC7 mov ax, di 0013.3C4B 3DFEFF cmp ax, FFFE < CUBASE.386 not loaded 0013.3C4E 7421 je 3C71 0013.3C50 3DFFFF cmp ax, FFFF < AX="FFFF" ? Dongle not present 0013.3C53 7402 je 3C57 < NOPPING this lets you run Cubase... this is how most of the crackers THOUGHT they got rid of the protection. Moving in AX a value like 0000 doesn't work too, by the way. 0013.3C55 EB4D jmp 3CA4 Ok, now let's hexedit your NOPS in the CUBASESC.EXE to let the program run and start again. As you can see, trying the things i told you before makes your system crash at random times and you have to reboot and reload SoftICE (very very frustrating!). What can we do? Don't worry, +Xoanon explains! Well, you noticed that when your system crashes softice popsup and tells you WHERE the crashes happens, at which instructions. We see, for Cubase, that this happens here (btw, it happens here if you try to create more than 2 or 3 tracks doubleclicking on the right window... could happen also on other instructions): * SYSTEM CRASH * * Referenced by a CALL at Addresses: |:0015.529A, :0015.53F9, :0015.5487, :0015.5588, :0015.5CFB |:0015.5E1B, :0015.AB6B, :0015.AB85, :0015.AC01, :0015.B513 |:0015.B73F, :0015.B9AA, :0015.BA51 | :0015.C5C6 45 inc bp :0015.C5C7 55 push bp :0015.C5C8 8BEC mov bp, sp :0015.C5CA 83EC08 sub sp, 0008 :0015.C5CD C45E06 les bx, [bp+06] :0015.C5D0 66268B4704 mov eax, es:[bx+04] < Executing one of :0015.C5D5 668946FC mov [bp-04], eax these MOV the prg :0015.C5D9 C45E06 les bx, [bp+06] crashes.... :0015.C5DC 66268B07 mov eax, es:[bx] INTERESTING! :0015.C5E0 668946F8 mov [bp-08], eax :0015.C5E4 C45EFC les bx, [bp-04] :0015.C5E7 268A474A mov al , es:[bx+4A] :0015.C5EB 98 cbw :0015.C5EC A809 test al, 09 :0015.C5EE 755A jne C64A :0015.C5F0 C45EFC les bx, [bp-04] :0015.C5F3 268A4735 mov al , es:[bx+35] So, this can be our "ENTRY POINT" !!! Reboot (ARGH!), reload and try to locate in memory the instructions at C5C6. This could be a little hard coz the program relocate everytime... Try doubleclicking to create a track AND pressing CTRL-D immediately (right after doubleclicking), now trace back, with F12, and try U cs:C5C6 until you see the following instructions... you could also need some stepping inside the code "of.class" tppabs="http://fravia.org/of.class" CUBASECM in order to find them. Or maybe you could try to find them in memory, with the search function. Hmm.... ok,ok... i already did it for you... i don't want you to stay awake the whole night trying to locate a "labile" instruction! Do the following: 1) Double click to create a track, and immediately CTRL-D 2) Do HEAP CUBSCM30 to see how the memory is occupied by Cubase 3) The correct handle is the one with: Lenght: 0000EBC0 Type: Code (obvious) Seg/Resrc: 0F 4) To be sure, do U ^THIS HANDLE^:C5C6 to see if it refers to the INC BP 5) If it doesn't, maybe that segment isn't loaded in memory yet... simply retry once more from step 1. Once found (hard eh?) set a BPX on the INC BP instruction and CTRl-D to reenter in Cubase. Try to create more tracks and..... BOOM! Softice breaks at your BPX! This is interesting... we see that this piece of code is called ONLY when Cubase decides to crash your system. Therefore we can try to find a "switch" in order to bypass it. Ok, now begins the real hard work... . STACK to see which calls are executed right before your BPX CUBSCM30(10) at 331F:019C [?] CUBSCM30(10) at 331F:0A41 [?] CUBSCM30(10) at 331F:AA9D [?] < This is the call WHICH got us> CUBSCM30 (0F) at 3327:c5c6
(c) Xoanon, 1997. All rights reversed.