Software Reverse Engineering - Finding Correct Serial Numbers Using The HMEMCPY Function Copyright (c) 1998 Volatility Document Courtesy of The Immortal Descendants - http://pages.prodigy.net/volatility --------------------------------------------------------------------------------------------- TABLE OF CONTENTS --------------------------------------------------------------------------------------------- I. Tools You'll Need For This Tutorial II. Understanding The HMEMCPY Function A. What Is HMEMCPY? B. Which Applications Use HMEMCPY? III. Software Reverse Engineering Using HMEMCPY A. When Will HMEMCPY Work? B. Setting Up Your Debugger To Break On HMEMCPY C. Common Things To Look For IV. Finding A Correct Serial Number Using HMEMCPY A. Prepare To Crack B. Making The Crack V. Final Thoughts --------------------------------------------------------------------------------------------- I. Tools You'll Need For This Tutorial --------------------------------------------------------------------------------------------- Target: Page 'O Labels For Mailing Labels v2.8 - (polml32.exe) 437,872 bytes. Download this at: http://members.aol.com/rksftp5/polml32.exe NOTE: This method will work for ALL software at http://www.rks-software.com Tools Needed: Soft-Ice (any version) --------------------------------------------------------------------------------------------- II. Understanding The HMEMCPY Function --------------------------------------------------------------------------------------------- A. What Is HMEMCPY? HMEMCPY is a Windows API call, which uses memory (RAM) to read, manipulate, compare and store strings (text you've entered into a program). The function takes the information you've entered (such as name and serial number in a registration screen) and puts them into memory. The function then proceeds to manipulate these strings, by moving and comparing them (for example, comparing the serial number you entered to the correct one), and then decides wether your string is correct or incorrect. The function then sends this information back to the application, and you proceed as good guy, or bad guy. B. Which Applications Use HMEMCPY? Many programs use HMEMCPY for many different reasons. For our purposes in this tutorial, we're mainly interested in shareware programs. The registration screens in shareware programs often utilize the HMEMCPY function to compare the information you entered with the correct information. If incorrect, you're still unregistered.. if correct, you're registered. --------------------------------------------------------------------------------------------- III. Software Reverse Engineering Using HMEMCPY --------------------------------------------------------------------------------------------- A. When Will HMEMCPY Work? HMEMCPY can be used to "trap" valid serial numbers for shareware programs. Using a debugger such as Soft-Ice, you can set a "breakpoint" on HMEMCPY, so that the debugger pops up when HMEMCPY is called. Now that your serial number, and most likely the correct one are stored in RAM, you can proceed to "fish" for your valid serial number. Many shareware programs utilize HMEMCPY for comparisons of serial numbers, and this method is extremely effective on applications written in Delphi or Visual Basic. B. Setting Up Your Debugger To Break On HMEMCPY In order to "break" into the routine where your serial number is compared with the correct one, you'll need to set up a "breakpoint" to "pop" your debugger up when the function is called. Using Soft-Ice, this couldn't be more simple. Run your program, go to the registration screen and enter in some "test" data. Press Cntrl+D to enter Soft-Ice, and type BPX HMEMCPY. BPX means Breakpoint on Execution, and you're telling Soft-Ice to break when HMEMCPY is called. After setting the breakpoint, press Cntrl+D again to exit back out to the program. Press the "Ok", "Register", or whichever button, and Soft-Ice will pop up. To get into the routine, you need to press F11. Now that you're inside the routine, you'll most likely see a string such as "USER(0A)" or (USER(01) on the line right above the command window. This isn't where you need to be. You need to be inside the program routine. If, for example, your program is called "Crack Me", you'll need to press F10 to step through the code, until you see a string such as "CRACKME!CODE" on the line above the command window. You'll need to press F10 to step through the code many times before you get to the place you need to be (I've found that a common number of times you need to press F10 is 79). You'll see different strings such as "USER(01)", "USER(1C)", "KERNEL32!_FREQASM", etc., as you step through the code. Normally, the program code is found right after "KERNEL32!_FREQASM". If you had to enter just a serial number, you can normally stop at the first instance of your program's code, but if you had to enter a user name AND a serial number, you'll need to continue stepping through all the functions again, until you get back to your program's code again. The first instance just manipulates the user name you entered, while the second instance manipulates your serial number. C. Common Things To Look For Once you get into your program's code, you'll need to start looking for a compare function (CMP, TEST) and/or a jump function (JZ, JNZ, JE, JNE, etc). When you find a compare, followed by a jump, this is usually right where you can find your valid serial number. A VERY common routine you'll see is as follows: --------------------------------------------------------------------------------------------- CALL 0041EF84 MOV EAX,[EBP-14] PUSH 00 CALL USER32!MessageBeep --------------------------------------------------------------------------------------------- To display the serial number you entered, step through the line "MOV EDX,[EBP-08]" so that the line "MOV EAX,[EBP-04]" is highlighted. Now display the EDX register by typing: d EDX. To display the correct serial number, press F10 twice so that the line "TEST AL,AL" is highlighted, and display the EDX register again. Press Alt plus your down arrow key a few times, and there's your correct serial number! Mine was "RKS-4059199". --------------------------------------------------------------------------------------------- V. Final Thoughts --------------------------------------------------------------------------------------------- I hope that this tutorial has given you some insight on finding correct serial numbers using the HMEMCPY function. If not, trash it! I won't be offended. If you feel I should add anything, or didn't clarify enough, feel free to let me know. You can contact me at: volatility@prodigy.net. Shout-Outs! - The Sandman (for his excellent website, tutorials and forums. Without them I'd be lost), Razzia (for his excellent tutorials on cracking Visual Basic programs), +Fravia (for the most comprehensive knowledge base on software reverse engineering available), and all fellow newbie crackers - don't give up! Failure is just the opportunity to start over again more intelligently! -Volatility-