__I'''''''''''''''''''''''''''''''''''''''''''I__ The Ultimate Begginer Cracker's Book v1.3__I'''''''''''''''''''''''''''''''''''''''''''I__ I by basdog22 I -------------------------------------------------------------------------------------------------------------------------------------------------- Well i started writing this tut cause there are NOT a lot of them availiable on the NET even now that knowledge is wide spreaded. This tut is aimed at the very newbies so if you are an advanced or an intermediate cracker through it away cause it just occupies space in your HDD and nothing more. I would like to apologise for my bad English and some spelling mistakes that i will for sure make here.English isn't my mother tongue so don't blame me ;) First of all: Make your notepad's resolution so that the line below will be shown in it's all length <------------------------------------------------------------------------------------------------------------------------------------------------> """"""""""""""""""""""""""""""""""""""""""""""Working with W32Dasm""""""""""""""""""""""""""""""""""""""""""""""""" Hello again,I hope things start to get clear to you now that you played with SICE a little bit.I know you practiced cracking my small prog and i know you found out that we must use both (our main) tools and not only SICE or W32Dasm but a combination of them.There will be progs that SICE can do nothing without W32Dasm and vice versa. I am also a newbie and i am stack at the unpacking shit.Now you might ask yourself "Why am i reading this shit if you are a newbie???".I have the answer to this.I think it is better to read tuts written by people who are in the same level with you because such people explain things better than advanced crackers who take some things forgranted (mmm bad English..).I have been reading tuts from advanced crackers and when it came to something so easy there was always the same phrase "If you don't know what this is,i suggest you read some low level tuts." ;=( So i still try to find these low level tuts.What i mean is that all tuts begin from a + newbie level and reach advanced, but what about this - newbie level (Pre - newbie as Detten calls it)??? So i decided to make a non-broken chain of tutorials starting from the Pre - Newbie level and reaching "whatever you wanna call it" intermediate level. Enough talking,lets crack. Patching patchme.exe ~~~~~~~~~~~~~~~~ In this tut i have included another prog called patchme.exe written in Visual Basic so you will need Harlequin's patch or VBRef both can be found at http://crackpltools.prv.pl/ (It is good to have them both). This one has the same way of working as crackme.exe but it doesn't exit itself. Step 1.Yes run the program and try to understand how it works (a must).It asks us for a serial,on bad serial a message pops-up telling us "This is the wrong way".Lets think how it would look like in Assembly: Push EDI,EAX <----------------------- Pushes our entered serial into EAX CMP EAX,EAX <---------------------- Compares our entered serial with the real one JNE (Bad boy) <--------------------- If the serial is wrong,jump to the Bad boy function Push (Good boy) <------------------- If not wrong display the Good boy message ... ... Bad boy function <----------------------------- It jumps here Push (This is the wrong way) <---- Display the Bad boy message ... ... After this step we will never be tricked by the code since we now how it looks like. Step 2. Disassemble patchme.exe and go to SDR (String Data References): "004052de" <-------------------- Might be a serial??? Yes this is a serial but not a lot of progs will be so easy "This is the wrong way" <---- Bad boy message??? "Welldone" <------------------- Good boy message??? D-Click on the second string and you will land here: ----------------------------------------------------------------Cut here----------------------------------------------------------------------- :00401DD0 52 push edx :00401DD1 EB41 jmp 00401E14 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00401D8E(C) <-------------------------------------------------------------<-------------- Our friend | :00401DD3 8D5594 lea edx, dword ptr [ebp-6C] :00401DD6 8D4DD4 lea ecx, dword ptr [ebp-2C] * Possible StringData Ref from Code Obj ->"This is the wrong way" <------ Bad boy function??? | :00401DD9 C7459C28184000 mov [ebp-64], 00401828 <------------------ We land here :00401DE0 C7459408000000 mov [ebp-6C], 00000008 * Reference To: MSVBVM60.__vbaVarDup, Ord:0000h | :00401DE7 FF1578104000 Call dword ptr [00401078] :00401DED 8D45A4 lea eax, dword ptr [ebp-5C] ----------------------------------------------------------------Cut here----------------------------------------------------------------------- So we land at 00401DD9 and if we look a little bit above we can see that this is referenced by a (C)onditional jump at 00401D8E Now do a Shift+F12 and write this address in the text box and hit OK.... kaboom we transfer here: ----------------------------------------------------------------Cut here----------------------------------------------------------------------- * Reference To: MSVBVM60.__vbaFreeObj, Ord:0000h | :00401D69 FF1590104000 Call dword ptr [00401090] :00401D6F B904000280 mov ecx, 80020004 :00401D74 B80A000000 mov eax, 0000000A :00401D79 663BF7 cmp si, di :00401D7C 894DAC mov dword ptr [ebp-54], ecx :00401D7F 8945A4 mov dword ptr [ebp-5C], eax :00401D82 894DBC mov dword ptr [ebp-44], ecx :00401D85 8945B4 mov dword ptr [ebp-4C], eax :00401D88 894DCC mov dword ptr [ebp-34], ecx :00401D8B 8945C4 mov dword ptr [ebp-3C], eax :00401D8E 7443 je 00401DD3 <-------------------------- We are here :00401D90 8D5594 lea edx, dword ptr [ebp-6C] :00401D93 8D4DD4 lea ecx, dword ptr [ebp-2C] * Possible StringData Ref from Code Obj ->"Welldone" <--------- Good boy function??? | :00401D96 C7459C10184000 mov [ebp-64], 00401810 :00401D9D C7459408000000 mov [ebp-6C], 00000008 * Reference To: MSVBVM60.__vbaVarDup, Ord:0000h | :00401DA4 FF1578104000 Call dword ptr [00401078] ----------------------------------------------------------------Cut here----------------------------------------------------------------------- So we have found something that looks like our guessing.Doesn't it? At 00401D79 it compares our entered serial with the real one and at 00401D8E there is a jump to the Bad boy function.So we are going to change this jump.We can Nop it by changing it to 9090 or we can reverse it to a JNE (7543). Fire up your Hex Editor and open patchme.exe make sure you have configured it to display the Offset and hexadecimal and look for the offset : 00001D8E. The offset is the number after the @ on the bottom line of W32Dasm.Now it should be @Offset 00001D8Eh in File:patchme.exe. The offset is 00001D8E. OK now you arrived at the offset try to find the number 7443 (it would be like that : 74 43) and change it to 7543.Save the file as patched.exe and close the hex editor. Now run patched.exe and enter any number, letter or a combination. "Welldone" Congrats you patched it. --------------------------------------------------------------------------------------------------------------------------------------------------- """"""""""""""""""""""""""""""""""""""""""""""""""""""Assembly"""""""""""""""""""""""""""""""""""""""""""""""""""""""" I am not the right person for you to learn Assembly from, but i will explain you the basics for this language. Registers ~~~~~~~ The most common of them are: EAX <---------------------------------- Used in Mathematical and I/O operations .\ EBX <---------------------------------- Used as base or pointer register \ ECX <---------------------------------- Often used in loops /"""""""" We will use them a lot EDX <---------------------------------- Simular to EBX / EAX and AX is the same thing just that for 32bit progs we place an E before Registers e.g: BX-->EBX Segment Registers ~~~~~~~~~~~~~~ CS <----------------------- The block of memory where the code is stored.\ ES <----------------------- The area in memory where the data is stored. \ SS <----------------------- Another data segment /""""""""""" Just to know they exist DS <----------------------- The stack segment / and others commonly used are: SI <---------------------------- The Source Index.A pointer within a segment.\ DI <---------------------------- Destination Index.Another pointer usually ES. \ BP <--------------------------- Base Pointer. /"""""""""" Very usefull to know what SP <--------------------------- Stack Pointer. / they do and how. Instructions ~~~~~~~~ MOV <-------------------------- Moves a value in a location in memory. eg: MOV AX, 0Ah INT <-------------------------- Generates an interrupt. eg: INT 3 <---- We will meet this shit a lot of times ADD <------------------------- Adds a number to the value stored in the register. eg: ADD EAX, 10h SUB <-------------------------- Substracts a number from the value stored in the register. eg: SUB EAX, 13h DEC <-------------------------- Decreaments something. eg: if AX=14h after a DEC AX, AX would be 13h INC <------------------------- Inreaments something. eg: if AX=13h after a INC AX, AX would be 14h JMP <------------------------- Jumps to a location. eg: JUMP 00401524 \ CALL <------------------------- Calls a function. eg: CALL 0040151D /"""""""""" We will be dealing with them LOOP <------------------------ Loops for a period of times. REP <------------------------ Repeats a function for the number of times specified in the ECX Register. CMP <------------------------- Compares two values and reflects the result in the Flags most times followed by a JUMP. <-------- This is the "BUG" we are trying to "fix". ;=)) AND <-------------------------- Performs a bit by bit comparison. eg: AND EAX,EDI XOR <-------------------------- performs a bit-by-bit exclusive OR operation. eg : XOR EAX,EBX NOT <-------------------------- Inverts the state of each bit in the operand. eg: NOT CX RET <-------------------------- Returns from subroutine eg: RET 0008 PUSH <------------------------- Pushes a register into the stack. eg: PUSH EAX Flags ~~~~ SF <------------------------------ Sign flag ZF <----------------------------- Zero flag ---------------------> We need this one AF <----------------------------- Auxillary flag PF <----------------------------- Parity flag CF <----------------------------- Carry flag OF <----------------------------- Overflow flag ---------------> and this one OK enough for today.I again suggest you to learn Assembly. Some of the references to Assembly were copied from Adam's Assembler Tutorial his homepage: http://www.faroc.com.au/~blackcat and his E-mail : blackcat@faroc.com.au --------------------------------------------------------------------------------------------------------------------------------------------------- """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" Thanks for reading this shit.I hope you gained some knowledge from this tut. My main goal was to help people who are interested in starting with the art of cracking (Not even newbies) but didn't know what tools to get and how to make them work. If you think that i should add some stuff in this tut or anything else you can send me your ideas to basdog22@yahoo.com i would apreciate it. """""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""" In my next tutorial version 1.4 we are going to crack IDA pro Demo.You can download it from http://crackpltools.prv.pl/ Till then go out there and have a drink with your girl and have fun cause the real life is out there... to be continued...