Cracking Projects For Newbies

Re: Project 6; Task3 question 1,2 (ANY COMMENTS SANDMAN?) Monday, 08-Feb-99 07:10:22 195.148.194.34 writes: Task 3 question 1 - Understanding The Serial Routine.. ======================================================= :0040B73A call 0040CCC0 Call to our serial compare routine.. :0040B73F add esp, 00000008 Add 8 bytes (2 dwords) to stack pointer, this instruction "destroys" our real and fake serial number from stack? :0040B742 test eax, eax Logical non desctructive and .. set flags... 1 and 1 = 1, 0 and 1 = 0, 0 and 0 =0 in case we have 1 in eax -> 1 (no zero flag set) and 0 in eax -> zero flag.. :0040B744 jne 0040B9BC jne means same as jnz (jump not zero)... in other words.. if function call returns 0 in eax -> thank for registering.., (no jump) other number -> jump to sorry.. nag box ;) function returns numbers to eax: FFFFFFFF = not valid serial number (-1) (signed long) 0 = valid serial number Task 3 question 2 - Understanding The Serial Routine.. ====================================================== This part was very hard.. because I am not assembler whiz ;) Comments and code looks very messy.. :0040B735 FF75E8 push [ebp-18] ; push pointer to our valid serial :0040B738 FF31 push dword ptr [ecx] ; push pointer to fake serial (Here we can fish our valid serial for Pirate Copy Serial: Arg02 = (LPSTR)"D06E1DA1260D6605" <- valid serial Name: Pirate Copy SN: D06E1DA1260D6605 ) translated to c: signed long check_is_serial_valid(char *fake, char *valid) (c-calling condition push valid push fake call.. eax=result (signed) ) :0040B73A E881150000 call 0040CCC0 --- call to our check serial routine: :0040CCC0 83EC04 sub esp, 00000004 ; sub dword from stackpointer.. why? :0040CCC3 833D24F1420000 cmp dword ptr [0042F124], 00000000 ; compare 00000000 to dword at address [0042f124] ; this set flags :0040CCCA 53 push ebx :0040CCCB 56 push esi ; push ebx and esi to stack :0040CCCC 7537 jne 0040CD05 ; if our comparation is not equal.. -> jump 1 :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] :0040CCD2 8B542414 mov edx, dword ptr [esp+14] ; load fake and real serials to ecx,edx :0040CCD6 8A01 mov al, byte ptr [ecx] ; move byte from address at ecx to al :0040CCD8 3A02 cmp al, byte ptr [edx] ; compare byte from address edx to al :0040CCDA 751E jne 0040CCFA ; jump if not equal -> jump 2 :0040CCDC 0AC0 or al, al ; test if al is zero :0040CCDE 7412 je 0040CCF2 ; jump if al is zero -> jump3 :0040CCE0 8A4101 mov al, byte ptr [ecx+01] ; move next byte from [ecx+01] to al :0040CCE3 3A4201 cmp al, byte ptr [edx+01] ; compare again.. :0040CCE6 7512 jne 0040CCFA ; jump if al not equal to byte.. -> jump 2 :0040CCE8 83C102 add ecx, 00000002 ; add ecx,2 :0040CCEB 83C202 add edx, 00000002 ; add edx,2 :0040CCEE 0AC0 or al, al ; test if al is zero :0040CCF0 75E4 jne 0040CCD6 ; jump if not zero -> jump 5 :0040CCF2 33C0 xor eax, eax ; zero eax (valid serial..) :0040CCF4 5E pop esi ; restore esi :0040CCF5 5B pop ebx ; restore ebx :0040CCF6 83C404 add esp, 00000004 ; add stackpointer to 4 bytes :0040CCF9 C3 ret ; return from function jump1: --------------- :0040CD05 6A19 push 00000019 ; push 19 to stack :0040CD07 E804200000 call 0040ED10 ; call :0040CD0C 8B4C2414 mov ecx, dword ptr [esp+14] ; mov [esp+14] to ecx :0040CD10 8B542418 mov edx, dword ptr [esp+18] ; mov [esp+18] to edx :0040CD14 83C404 add esp, 00000004 ; add 4 bytes to stackpointer.. * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CD89(C) | :0040CD17 41 inc ecx ; +1 to ecx :0040CD18 33C0 xor eax, eax ; zero eax :0040CD1A 660FB659FF movzx bx, byte ptr [ecx-01] ; moves something ??? to bx :0040CD1F 8AC3 mov al, bl ; bl -> al :0040CD21 F68021F0420004 test byte ptr [eax+0042F021], 04 ; test [eax+..], 04 - ?? :0040CD28 7417 je 0040CD41 ; jump if equal.. :0040CD2A 8A01 mov al, byte ptr [ecx] ; [ecx] -> al :0040CD2C 84C0 test al, al ; test if al zero :0040CD2E 7505 jne 0040CD35 ; jump not zero... :0040CD30 6633DB xor bx, bx ; zero bx :0040CD33 EB0C jmp 0040CD41 ; jmp to ... jump2: :0040CCFA 1BC0 sbb eax, eax ; sbb?? :0040CCFC 5E pop esi ; restore esi :0040CCFD 83D8FF sbb eax, FFFFFFFF ; sbb?? :0040CD00 5B pop ebx ; restore ebx :0040CD01 83C404 add esp, 00000004 ; add dword to stackpointer :0040CD04 C3 ret ; return jump 5 |:0040CCF0(C) | :0040CCD6 8A01 mov al, byte ptr [ecx] ; [ecx] -> al :0040CCD8 3A02 cmp al, byte ptr [edx] ; compare.. :0040CCDA 751E jne 0040CCFA ; not equal jump to jump 2 :0040CCDC 0AC0 or al, al ; check if zero :0040CCDE 7412 je 0040CCF2 ; zero :0040CCE0 8A4101 mov al, byte ptr [ecx+01] :0040CCE3 3A4201 cmp al, byte ptr [edx+01] :0040CCE6 7512 jne 0040CCFA ; not equall.. jump to 2 :0040CCE8 83C102 add ecx, 00000002 :0040CCEB 83C202 add edx, 00000002 :0040CCEE 0AC0 or al, al :0040CCF0 75E4 jne 0040CCD6 ; al is not zero.. jump to jump 5 jump 3: * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CCDE(C) | :0040CCF2 33C0 xor eax, eax :0040CCF4 5E pop esi :0040CCF5 5B pop ebx :0040CCF6 83C404 add esp, 00000004 :0040CCF9 C3 ret ; this it clear.. zero eax,eax.. return... etc ;) Let's analyse it a bit: First comparation: if [0042F124] it not zero jump1.. compare byte if not equal jump2 jump3 if eax = 0 compare next byte if not equal jump2 add ecx,edx +2 test if al = zero jump not zero jump 5 zero eax (valid serial) return :jump1 call some function? remove reg info from reg? load values ecx,edx ecx +1 zero eax movswz.. some mystic string opcode test if eax is 04 byte set? something missing ;) :jump2 eax -> -1 (FFFFFFF) return :jump3 eax = 0 (valid serial) return :jump5 compare bytes if not equal jump to jump2 else valid serial Task 3 - question 3. ===================== Not found.. not clear.. Shadow

Message thread:

Shadow: Project 6; General (03-Feb-99 05:42:39)

Shadow: Re: Project 6; My analysis about how program works.. (03-Feb-99 10:11:05)

Shadow: Re: Re: Project 6; Task2 - patch (05-Feb-99 01:34:47)

Shadow: Re: Re: Re: Project 6; Task2 - 1 byte solution found! (08-Feb-99 00:47:44)

Shadow: Project 6; Task3 - some help needed! (08-Feb-99 02:21:11)

Shadow: Re: Project 6; Task3 question 1,2 (ANY COMMENTS SANDMAN?) (08-Feb-99 07:10:22)

Back to main board

Message subject: Name: (optional) Email address: (optional) Type your message here:

Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.