                     Jak Zrobic dobre Crackme.
                    Writeln by CoxoC    CookieCrK
-----------------------------------------------------------------------------
[.wstep.]

        Pewnego razu tak sobie siedzialem nad jadrami systemu windows 98
oraz systemu
windows 95 i ....

[.disassembler.]

a wiec zdisasssemblerowalem biblioteke KERNEL32.DLL 

Z KERNEL32.DLL z WIN98 mamy

Exported fn(): SetUnhandledExceptionFilter - Ord:02EEh
:BFF9D5FE A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFF9D603 8B542404                mov edx, dword ptr [esp+04]
:BFF9D607 8B08                    mov ecx, dword ptr [eax]
:BFF9D609 81C19C000000            add ecx, 0000009C
:BFF9D60F 8B01                    mov eax, dword ptr [ecx]
:BFF9D611 8911                    mov dword ptr [ecx], edx
:BFF9D613 C20400                  ret 0004

Exported fn(): IsDebuggerPresent - Ord:021Bh
:BFF945D6 A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFF945DB 8B08                    mov ecx, dword ptr [eax]
:BFF945DD 83795401                cmp dword ptr [ecx+54], 00000001
:BFF945E1 1BC0                    sbb eax, eax
:BFF945E3 40                      inc eax
:BFF945E4 C3                      ret

Exported fn(): AreFileApisANSI - Ord:007Eh
:BFFA21DA A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFFA21DF 8B08                    mov ecx, dword ptr [eax]
:BFFA21E1 8B4120                  mov eax, dword ptr [ecx+20]
:BFFA21E4 83E040                  and eax, 00000040
:BFFA21E7 83F801                  cmp eax, 00000001
:BFFA21EA 1BC0                    sbb eax, eax
:BFFA21EC F7D8                    neg eax
:BFFA21EE C3                      ret


Exported fn(): SetFileApisToANSI - Ord:02CBh
:BFFA21C2 A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFFA21C7 8B08                    mov ecx, dword ptr [eax]
:BFFA21C9 806120BF                and byte ptr [ecx+20], BF
:BFFA21CD C3                      ret



Exported fn(): SetFileApisToOEM - Ord:02CCh
:BFFA21CE A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFFA21D3 8B08                    mov ecx, dword ptr [eax]
:BFFA21D5 80492040                or byte ptr [ecx+20], 40
:BFFA21D9 C3                      ret


Exported fn(): LocalShrink - Ord:0239h
:BFFA05D8 2BD2                    sub edx, edx
:BFFA05DA 68C718FABF              push BFFA18C7
:BFFA05DF 64FF32                  push dword ptr fs:[edx]
:BFFA05E2 648922                  mov dword ptr fs:[edx], esp
:BFFA05E5 8B4C240C                mov ecx, dword ptr [esp+0C]
:BFFA05E9 8A4107                  mov al, byte ptr [ecx+07]
:BFFA05EC 8A41FC                  mov al, byte ptr [ecx-04]
:BFFA05EF 648F02                  pop dword ptr fs:[edx]
:BFFA05F2 83C404                  add esp, 00000004
:BFFA05F5 E99B96FFFF              jmp BFF99C95
:BFF99C95 A1DC9CFCBF              mov eax, dword ptr [BFFC9CDC]
:BFF99C9A 8B08                    mov ecx, dword ptr [eax]
:BFF99C9C 8B5118                  mov edx, dword ptr [ecx+18]
:BFF99C9F 8B02                    mov eax, dword ptr [edx]
:BFF99CA1 C20800                  ret 0008


Z KERNEL32.DLL z WIN95 mamy


Exported fn(): SetUnhandledExceptionFilter - Ord:02A4h
:BFF9A4C1 A17CC2FBBF              mov eax, dword ptr [BFFBC27C]
:BFF9A4C6 8B4C2404                mov ecx, dword ptr [esp+04]
:BFF9A4CA 8B10                    mov edx, dword ptr [eax]
:BFF9A4CC 8B8298000000            mov eax, dword ptr [edx+00000098]
:BFF9A4D2 898A98000000            mov dword ptr [edx+00000098], ecx
:BFF9A4D8 C20400                  ret 0004

W tej bibliotece nie ma IsDebuggerPresent ale mozna identycznie sprawdzac
pole 54h tak samo jak to czyni system w win98

Exported fn(): AreFileApisANSI - Ord:006Ah
:BFF9EA7B A17CC2FBBF              mov eax, dword ptr [BFFBC27C]
:BFF9EA80 8B08                    mov ecx, dword ptr [eax]
:BFF9EA82 8B4120                  mov eax, dword ptr [ecx+20]
:BFF9EA85 83E040                  and eax, 00000040
:BFF9EA88 83F801                  cmp eax, 00000001
:BFF9EA8B 1BC0                    sbb eax, eax
:BFF9EA8D F7D8                    neg eax
:BFF9EA8F C3                      ret

Exported fn(): SetFileApisToANSI - Ord:0287h
:BFF9EA63 A17CC2FBBF              mov eax, dword ptr [BFFBC27C]
:BFF9EA68 8B08                    mov ecx, dword ptr [eax]
:BFF9EA6A 806120BF                and byte ptr [ecx+20], BF
:BFF9EA6E C3                      ret

Exported fn(): SetFileApisToOEM - Ord:0288h
:BFF9EA6F A17CC2FBBF              mov eax, dword ptr [BFFBC27C]
:BFF9EA74 8B08                    mov ecx, dword ptr [eax]
:BFF9EA76 80492040                or byte ptr [ecx+20], 40
:BFF9EA7A C3                      ret

Exported fn(): LocalShrink - Ord:01FFh
:BFF9D021 2BD2                    sub edx, edx
:BFF9D023 6897E2F9BF              push BFF9E297
:BFF9D028 64FF32                  push dword ptr fs:[edx]
:BFF9D02B 648922                  mov dword ptr fs:[edx], esp
:BFF9D02E 8B4C240C                mov ecx, dword ptr [esp+0C]
:BFF9D032 8A4107                  mov al, byte ptr [ecx+07]
:BFF9D035 8A41FC                  mov al, byte ptr [ecx-04]
:BFF9D038 648F02                  pop dword ptr fs:[edx]
:BFF9D03B 83C404                  add esp, 00000004
:BFF9D03E E91C9DFFFF              jmp BFF96D5F
:BFF96D5F A17CC2FBBF              mov eax, dword ptr [BFFBC27C]
:BFF96D64 8B08                    mov ecx, dword ptr [eax]
:BFF96D66 8B5118                  mov edx, dword ptr [ecx+18]
:BFF96D69 8B02                    mov eax, dword ptr [edx]
:BFF96D6B C20800                  ret 0008



[.wnioski.]

Hmm istnieje w tych procedurach pewna analogia - wszystkie one korzystaja
z tablicy PROCESS DATABASE. Zauwazmy,ze wszystkie one (z jednym wyjatkiem)
pozostawiaja w rejestrze ECX wskaznik do tej tablicy :)

Przedstawiam czesc tej tablicy ("Windows 95 System Programming SECRETS" by
Matt Pietrek):

18h     DWORD   DefaultHeap
        This DWORD contains the address of the default process heap.
        GetProcessHeap returns this value for the current process.

1Cb     DWORD   MemoryContext
        This DWORD is a pointer to the process's memory context. A memory
        context contains the page directory mappings necessary to provide
a process
        with its own private region in the 4GB address space. Chapter 5
describes
        memory contexts in more detail.

20h     DWORD flags
        These flags are described in the following table:

        Flag name and bit value         Description
        FDebugSingle                    Set if process is being debugged.
        0x00000001
        fCreateProcessEvent             Set in debugged processes after
starting.
        0x00000002
        fExitProcessEvent               Might be set in debugged processes
at exit time
        0x00000004
        fWin16Process                   A 16-bit program
        0x00000008
        fDosProcess                     A DOS program
        0x00000010
        fConsoleProcess                 A console (text mode) Win32
process.
        0x00000020
        fFileApisAerOem                 See SetFileApisToOEM()
        0x00000040
        fNukeProcess
        0x00000080

54h     DWORD WaitNodeList
        If the thread is waiting for one or more events to be signaled,
this field
        points to a linked list of event nodes stored up in VxD land. Each
node
        holds a pointer to an event object and a pointer to the thread
that's
        waiting on the event.

9Ch     DWORD TopExcFilter
        This DWORD holds the "Top Exception Filter" for the process. This
is the
        routine that will be called if no other exception handlers choose
to handle
        an exception. This value is set via the
SetUnhandledExceptionFilter func-tion.
        Structured exception handling is discussed later in the chapter.


[.zastosowanie.]

        Dochodzimy wiec do pytania jak to wykorzystac ale w kodzie
wlasnego crackme !
        Hmm wiec np chcemy skorzystac z procedurki IsDebuggerPresent w
naszym crackme ale
        czujemy ze to jest marne zabezpieczenie proste do ominiecia :(
.... 
        Zamiast niej mozna zastosowac np taki kod :

                        Call AreFileApisANSI            ;w ECX wskaznik do
tablicy teraz :
                        cmp dword ptr [ecx+54h], 00000001
                        sbb eax, eax
                        inc eax                         ;no i w eax mamy
wynik procki 
                                                        ;IsDebuggerPresent

        Sprytne nie ? mozna takze zkorzystac z pola 20h i z flagow
FDebugSingle 
        i fCreateProcessEvent  !!! wtedy przez np. wykorzystanie polecenia
TEST mozna 
        sprawdzic flagi i wyciagac wnioski !!!
-----------------------------------------------------------------------------
CookieCrK 1999
visit: http://www.cookiecrk.z.pl