Assembly and Cracking From the Ground Up
An Introduction by Greythorne the Technomancer


It is probably no small surprise to you, if you are reading this to get familiar with assembly and cracking,
that i have over the last several years, had many requests (and seen many requests online) for something that could help a newer person get into the many tutorials on assembly and cracking topics that exist on the net.

...Considering most all of them require at least an intermediate knowledge of the subject, and some,
not jokingly, a doctorate to understand. Wouldn't it be nice if something were available that would be able to bring you more up to speed with the existing tutorials?

Hopefully this will help.



In this lesson, you will need some fundamental tools,

just like any other tutorial you will find on the net.


They Are:

TASM (Borland's Turbo Assembler)
It shouldn't really matter as to the version, but I have 3,4 and 5 if you really must know.

NuMega SoftIce Debugger
I am using 3.22 for Win95 and for WinNT with
DLDR.EXE from DOS softice

PowerC Compiler
Available from www.mixsoftware.com or old cdroms you might locate all over the place
and for convenience sake, it is a very nice C compiler that actually fits on a floppy!


Sourcer Disassembler
A very nice DOS based disassembler with the added
feature of allowing you to re-compilable its assembly code for the assembler of your choice

Wdasm32 Windows Disassembler
A decent disassembler designed primary for windows programs - easier to use than most and so it tends to be a good choice for beginners - and though it cant disassemble everything whereas IDA can, it can lead to a much quicker result on most Win32 programs

IDA Interactive Disassembler
The Ultimate Disassembler! - This thing does the best job disassembling things in a wide array of languages on a wide array of computer platforms - Similar to SoftICE in capability, and can disassembly programs that Wdasm32 simply cannot handle

Additional programs will be added to this list as necessary



TOPICS TO BE COVERED IN THIS LESSON
(This will undoubtedly change many times to accomodate requests)

An introduction to Hexadecimal and Binary numbers
Intro to Program Development (All Languages)

Writing Programs in Assembly Language

Translation of Assembly 'Commands'

.EXE and .COM file templates

Part I: Registers, Hello World
Part II: Our First Interactive Program
Part III: Modularity and Procedures (Ideal Mode)
Part IV: Command Line Parsing

Necessary Assembly Example Code

A Mini C Tutorial

How to set up your tools: SoftICE

SoftICE'95 Handy Windows Breakpoints (WIN32API.TXT)
Reverse Engineering your own C and Assembly examples
Real World Examples: Using What You Know

_HaK_ has developed some excellent Win32 Starter Tutorials that - though they are geared toward making win32 apps in assembly, this is precisely what you need to read... the explanation of all those wm_commands for example (need I say more?)

Additional tools, such as the win32 help file and interrupt list (and a few other things that may have been cut from my links in the past such as HelpPC and Art of Assembly) are HERE


GIJ has done a huge amount of work lately
and will be making a site for it's display
this section is a pre-mirror until gij's page(s) are ready.
(originally some of this was at my request,
but gij went above and beyond as you can see!)

* 2 dimensional math in assembly for matrix styled keygens
* Using SoftICE for symbolic debugging (useful!!!)
* Finding hidden 'easter eggs' in programs (MineSweeper I)
* Fixing a bug and NE file format (MineSweeper II)
* Making a Trainer (MineSweeper III)
* Defeating server-based-protections using API Hooking (w/Source)
* New user tutorial on IDA (interactive dissassembler)
* How to load IDA symbols into SoftICE (very nice!!!)
* NASM toolkit for win32 apps (sorely needed!)

NetWalker Debugger (win32 debugger programming example)

Ghiribizzio made a nice IDA tutorial as well
download it HERE (ghiric32.zip 844,056 bytes) with the ghost program
included, or go to to MEXELITE and download the text only
version from their tutorials section -- both have the ida database included
(while you are there check out the other tutorials as well!)


For fun, try making a batch file to run idaw.exe
rather than running idaw.exe from windows...
that way you can re-size the dos box by font size
since idaw.exe is normally a nonresizeable
window in many configurations without editing
the config file outright - and it is faster!

IDA.BAT BATCH FILE CONTENTS:

@idaw.exe %1 %2 %3 %4 %5 %6 %7 %8 %9


A useful IDA tip from NewbCrack...

If you make the above batch file in your IDA
directory, put a shortcut in your c:\windows\sendto directory
and you can right click on anything in windows and send it to ida
directly without having to hunt for the directory!

+Gthorne Note:

(don't link to the idaw.exe in sendto - it tends to drop database files
on your desktop - so make sure to link to the batch file instead as a fix)

Wanna know what all those machine language opcodes are?
HERE is a nice file you may want...
It is an opcode reference converted to WinHelp format by HUTCH
The source of the original intel opcodes text was submitted to him anonymously

And HERE is a cool little mnemonic window - this is an extremely handy tool - a tiny window with translated assembly byte codes (again from Hutch)

If you use UltraEdit (excellent editor that highlights in color any language you specify)
HERE is a replacement for the WORDFILE.TXT which includes updated
x86 assembly highlights which were submitted to me by I_MAGNUS
HERE is my WORDFILE.TXT which includes the basic stuff from ultra edit
as well as the above assembly list - save this over your default
wordfile.txt in your ultraedit directory and you are all set!

HelpPC.Zip (263,711 bytes) - Invaluable Assembly Tool
This program is a necessity for all levels of programmers!

Much of cracking requires knowledge of interrupts, so download this
Pre-Combined Interrupt List 55 (1,186,607 byte zip / 28-SEP-1997)


And check out Ralf Brown's Interrupt List Site
(Constantly updated version of the Above List)


And the Art of Assembly - Advanced Assembly Book Online
Or download the 4,594,814 byte sized copy of it in PDF format HERE
Read PDF files with adobe's acrobat reader - either get it off the web
or out of OrcPak4B.ZIP in my orcpaks directory.

For those a little more into coding,
here are some files on Win'95's PE header


ms_pe.txt
win95.txt
win95pe.txt

Recently I have found a book that I would recommend
to any aspiring Assembly Students out there.

Mastering Turbo Assembler
By Sam's Publishing

For a Little Taste, Here are the Assembly Files
That Come With It In This
Self-Extracting Archive


If you are really gamey and wanna see some advanced assembly
in motion, see my symbiote.zip which is a program source
that allows you to add your own assembly code to other proggies
in a similar way that a virus attaches itself - though this has no bad
functions unless you put them in there...
(I know - I wrote it -- so don't go blaming me if you get it
somewhere else and it does something strange ;)

Every now and again someone comes up with a question about patchers...

HERE is some source code for a special search patcher
that was created by an old friend of mine, Onurb.


Here is definately one of the most well designed and commented
assembly resource pages I have ever seen:


Salvador's Assembly Links



One interesting Site referred to me by Razzia




And The Visual Assembler Project!



My Friends in irc channel #cracking4newbies have written a nice starting
softice tutorial - access it

HERE

If you are interested in DOS level device drivers,
here is the assembly source you need

I have an affinity for small apps that can be emailed or transported easily on a floppy... heres yet another tiny assembler: The Wolf Assembler


In the spirit which Fravia and myself have been so fond, I am completely open and welcome to submissions from people who want to immortalize themselves by writing sections for this tutorial. Certain submissions are more interesting of course than others. I will end up rewriting most if not all of them for ease of reading and to include my own comments. All submissions will receive credit to their originators (by pseudonym) unless complete anonymity is requested.


+gthorne'97