L0phtCrack 2.52 for Win95/NT  -  Cracking Tutorial by Goatass

--------------------------------------------------------------

  BEGINNER (X) - NEWBIE () - INTERMEDIATE () - ADVANCED ()





	First off, L0phat Heavy Industries is one of the best

hacking groups out there today along with some others that release

some of the best hacking/security tools. I am a newbie but I will

do my best to teach you how to crack L0phtCrack 2.52 which is the

latest NT password cracking tool.





About this protection:

-----------------------

This is a very simple time trial/serial number protection. An unlock

code gets compared with a pre-assigned serial number.  I was very

surprised to find out that such a great hacking group didn't bother

to protect their trademark tool very well. They are selling it for $100.



Ok well lets get going with the crack.







What you will need:

--------------------



- L0phtCrack 2.52    (http://www.l0pht.com/l0phtcrack/)



- SoftIce



- your eyes







The crack:

-----------



This is a memory echo crack which should be very easy for all newbies.

First off, make a backup of l0phtcrack.exe incase you screw something up.

Run the program and you should see a nag screen showing you how many days

you have left (15 days total) and there is also a "Register" button. 

Click the "Register" button and you should see a dialog box with a 

grayed out box with the pre-assigned serial number and below it there 

will be a box for your unlock code.  The unlock code is alphnumeric but

that doesn't matter right now. Go ahead and put any number you like, I 

used 12345678 for my unlock code.



Now go into SoftIce (CTRL+D) and set a breakpoint on GetWindowTextA

(BPX GetWindowTextA). The approach here is to break right after the

program reads your unlock code and then uses it along with the 

pre-assigned serial number to generate and compare the good unlock code.

Now get out of SoftIce (X) and click the OK button. SoftIce breaks, 

press F11 to return to the calling function, that read in the 

pre-assigned serial number. Now press F5 to read your unlock code, 

SoftIce breaks a second time, press F11 again and now you are in the

program's code. Trace through the code until you get to this part:



:406345	MOV	EAX, [EBX]         <-- if you type D EAX you will see 

				       the code you entered.

:406347	LEA	ECX, [ESP+1C]      <-- here is the unlock code,  D ECX

				       to see it.



If you dump ECX you will see two 8 digit alphanumeric strings they are

both the correct unlock codes. Why two ? you'll see in a second.



Next we see the program PUSHing EAX and ECX onto the stack then comes

the CALL to compare the codes.





:40634D	CALL	00426260           <-- this is where the program compares

				       your number and the first unlock

				       code. Since you entered a wrong 

				       code the CALL will return with 

				       EAX=FFFFFFFF (-01), if the code 

				       you entered was correct it would

				       return with EAX=00000000

:406355	TEST	EAX, EAX	   <-- checks to see what the CALL returned,

				       if the code is good or not.

:406357	JZ	004063A2	   <-- if the CALL returned 00, good code,

				       jump to "Thank You"



Now the program gives you another try and does the exact same thing as

above with the second code.



:406359	MOV	EAX, [EBX]	   <-- here is your the code you entered

:40635B	LEA	EDX, [ESP+2C]      <-- and here is the second unlock code,

 				       type D EDX to see the 2nd code

....

:406361	CALL	00426260	   <-- here is that same call for comparing

				       the codes, same as before the 

				       program will return EAX=FFFFFFFF (-01)

....



I skipped some code here that does the same as above with the TEST and 

JZ. Since the code you entered was wrong the program proceeds to the 

nag screen:



:406376	CALL	0045666B           <-- this is the call to display the nag

			               screen.



Now you can get out of SoftIce and try your new unlock code and you'll 

be registered.



There are a few ways of going about cracking this program, the easiest

would be what I have described above but if you want you can force the

jump at 406357 by changing it from JZ to JMP but why screw with the code

if you don't have to.



Another way is to use the program to create a small KeyGen. By changing

one of the two PUSHes before the CALL to the nag screen at 406361 and

making it display the correct code,  PUSH [ESP+1C] or PUSH [ESP+2C].







The End:

---------



That's all for this tutorial I hope I helped you better understand the

memory echo concept. This was a very easy crack but keep in mind that 

many other programs use the same way for protection.



I just want to say THANK YOU to my mentor zip for getting me started 

with cracking. Also great thanks goes out to EDiSON, +ORC, Fravia, 

CrackZ, Sandman and all the great people who reverse for knowledge, 

keep writing those great tutorials.



I'm out, PEACE !



Goatass