| Target Program: |
DownloadWizard Plus 2.50 |
| Description: |
DownloadWizard Plus is your Internet Download
Manager, which can also manage bookmarks and desktop shortcuts. With DownloadWizard you
can download files as usual, create bookmarks as usual, create shortcuts on your desktop
and manage them, use full ZIP/UNZIP functionality, look for everything you have
downloaded. |
| Location: |
http://www.downloadwizard.net |
| Protection: |
Name / Serial |
| Tools needed: |
- SoftICE 3.24 |
| Ob duh: |
Do I really have to remind you
all that by BUYING and NOT stealing the software you use will ensure that these software
houses will continue to produce even *better* software for us to use and more importantly,
to continue offering even more challenges to breaking their often weak protection systems.
BTW, It's illegal to use cracked Software!
If you're looking for
cracks or serial numbers from these pages then your wasting your time, try to search
elsewhere on the Web under Warez, Cracks, etc. |
| Info: |
Brand and product names are trademarks or registered
trademarks of their respective holders. |
| Level: |
(X)Beginner ( )Intermediate ( )Advanced ( )Expert |
|
Well I get
more and more mails asking me what breakpoints can be set in case HMEMCPY didn't work.
Altough I've included that question to the FAQ part of the cRACKER's n0TES already I still get such mails. I hope
that with the help of this tutorial people can also master these without asking me for
help.
First of all we need to execute our target - so do this now. A well-designed
message box pops up. It informs you how many days and executions are left in your trial
period. There's also a nice Register button, which you should
press now. Another message box pops up. This message box is asking for your name and
registration code. The registration code should look like A-B-C-D.
We know already enough about this program - so we can crack it just now. So enter
you're favourite registration details (I've chosen PIRATED COPY as name and
1234-5678-90AB-CDEF as registration code). Now enter SoftICE and set a BPX to HMEMCPY then
leave SoftICE and press the OK-Button!
After some tracing through the code you'll get something like the following code
snippet:
:004467CB CALL [EBP+0C]
:004467CE POP ECX
:004467CF XOR EAX,EAX
:004467D1 POP EBP
:004467D2 RET |
Now you could set a BPX to
that CALL - anyway it's just generated because of the message box (I think). And what
would you do in cases no message box informs you? Well maybe you would be lost ... so
better practise now! If you have any Win32 Reference close to you I highly recommend
trying to find out what you could also BPX ... I'm sure you will find other useful pieces
of informations by studying this Reference. In case you didn't know you may use QuickView,
which is included in every Win95/98 version. Look at the IMPORTS of the program. You will
find several useful ones. By using your brain a bit you will come accross SendDlgItemMessageA.
Well I tell you this is the right thing to BPX on. So do this now ... and press the
OK-Button again.
SoftICE pops up and the following code snippet is displayed:
:0040A01C CALL USER32!SendDlgItemMessageA
:0040A021 PUSH 00
:0040A023 PUSH 03
:0040A025 PUSH EDI
:0040A026 CALL 00420ED4
:0040A02B ADD ESP,0C
:0040A02E PUSH EDI
:0040A02F MOV EAX,[EBX+19]
:0040A032 ADD EAX,21
:0040A035 PUSH EAX
:0040A036 CALL 0045F108
:0040A03B ADD ESP,08
:0040A03E INC ESI
:0040A03F CMP ESI,04
; (1)
:0040A042 JLE 00409FF5
; (2)
:0040A044 PUSH DWORD PTR [EBX+19]
:0040A047 PUSH 21
:0040A049 PUSH 0D
:0040A04B PUSH 69
:0040A04D MOV EDX,[EBX]
:0040A04F PUSH DWORD PTR [EDX+0C]
:0040A052 CALL USER32!SendDlgItemMessageA
; (3)
:0040A057 PUSH 00
:0040A059 PUSH 03
:0040A05B PUSH DWORD PTR [EBX+19]
:0040A05E CALL 00420ED4
:0040A063 ADD ESP,0C
:0040A066 PUSH DWORD PTR [EBX+19]
:0040A069 CALL 0040974D
; (4)
:0040A06E POP ECX
:0040A06F TEST EAX,EAX
:0040A071 JNZ 0040A099
; (5)
... ...
:0040A092 CALL USER32!MessageBoxExA
; (6)
:0040A097 JMP 0040A0A0
:0040A099 PUSH EBX
:0040A09A CALL 0045208A
:0040A09F POP ECX
:0040A0A0 POP EDI
... ...
:0040A0A6 RET |
Well I think you can
understand the above code snippet, since it just increases the number of serial fields,
read them out and checks if it has read out all 4 fields (1). If so the JLE at (2) won't
be executed. Then the name is read out (3). After all the serial is checked (4). If
everything is ok, the JNZ (5) will be executed - else a message box telling you that your
registration details are invalid is displayed (6). So we need to enter the CALL at 40A069
(4).
As you have enterd the CALL, the following code snippet will be displayed:
:0040974D PUSH EBP
... ...
:0040978A PUSH EBX
; (7)
:0040978B LEA EAX,[EBP-38]
:0040978E PUSH EAX
; (8)
:0040978F CALL 0040967D
:0040979B RET |
I've cut of a large snippet
of code since it's *not* interesting for us. If you feel interested in the code snippet -
just trace through it - you will find out several things which might be useful one day
(find this out yourself - that way you will learn most).
At 40978A EBX contains our fake serial and at 40978E EAX contains our name. Now you
can even guess what's going on. Of course we have to enter this last CALL before the
RETurn, which is the deciding check whether the serial is correct or not. As you have
enterd it the following code snippet will be displayed:
:0040967D PUSH EBP
:0040967E MOV EBP,ESP
:00409680 MOV EAX,[EBP+08]
:00409683 PUSH 00
:00409685 PUSH 00
:00409687 PUSH DWORD PTR [EBP+0C]
:0040968A ADD EAX,21
:0040968D PUSH EAX
; (9)
:0040968E CALL 00421009
;
(A)
:00409693 ADD ESP,10
:00409696 POP EBP
:00409697 RET |
Well at 40968D (9) the real
serial number is PUSHed and at 40968E (A) it is checked ... The serial for PIRATED COPY is
3123-3095-4085-3303. If you want to produce a KeyGEN for this program you have to trace
lots of code ... and I don't have the time to do that at the moment ... maybe I have more
time in the future - anyway I think and hope you have learned something from this
tutorial. If you have done so, please drop me a mail.
BTW, Your registration details are storen in DW.CFG - as you may know or find out
using a monitoring tool like FileMon.
Another target has been Reverse Engineerd. Any questions (no crack requests)?
|