home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Reverse Code Engineering RCE CD +sandman 2000
/
ReverseCodeEngineeringRceCdsandman2000.iso
/
RCE
/
E_bliss
/
eb_tut6.txt
< prev
next >
Wrap
Text File
|
2000-05-25
|
6KB
|
160 lines
Tutorial Number 6
Written by Etenal Bliss
Email: Eternal_Bliss@hotmail.com
Website:http://crackmes.cjb.net
http://surf.to/crackmes
Date written:2nd Feb 1999
Program Details:
Name: CrackMe v2.0a
Author: Borna Janes
Language: Visual Basic 6
Tools Used:
NuMega SmartCheck 6.01
Cracking Method:
Understanding and Analyzing Data in SmartCheck
Viewing Method:
Use Notepad with Word Wrap switched on
Screen Area set to 800 X 600 pixels (Optional)
__________________________________________________________________________
Foreword
Before you read the following, I suggest that you go to my website and read
my two essays on VB cracking first. You will find the common breakpoints
and some uncommon ones. And there are explanation on what they are for.
Also, I have described the common things you will see in SmartCheck as well.
They will aid in understanding all the information given by SmartCheck and
are definitely useful.
__________________________________________________________________________
About this protection system
No disabled function. Protection is based on a 9 digit combination which
are compared one by one. Before any serial is checked, the length is
compared first. If it is not 9 characters, no checking is done.
__________________________________________________________________________
The Essay
As this is a tutorial for newbies, I'll go into details about how I go about
cracking the program. I suggest that you read this tutorial first.
When you have completed the tutorial, leave this tutorial open and follow
the instructions while using SmartCheck. Re-do it once more after you have
completed the step by step guide...
__________________________________________________________________________
Understanding and Analysis
Run SmartCheck. Load the program using it by using "File", "Open"
and choose Bjcm20a.exe
If this is your first time using SmartCheck, do the following:-
Under Program Settings:-
Error Detection: "tick" all boxes except "Report errors immediately".
Advanced: "tick" first 4 boxes.
Make sure "Suppress system API and OLE calls" is not "ticked".
Reporting: All boxes "ticked" except for "Report MouseMove events
from OCX controls"
**I have captured the images of the three boxes for better reference. They are
available on http://crackmes.cjb.net or http://surf.to/crackmes
Run Bjcm20a.exe in SmartCheck by pressing F5. Type in any registration
code you want. (I used 99999999) Then click "Check It". You will get an
error message. Exit the program.
Ok. You will see a few lines in the left window. Look for Command1_Click.
**This is the subroutine in VB that is called when you click on the
"Check It" button.
Click on the "+" sign next to Command1_Click to expand the thread in it.
You will notice that there are only 3 lines.
The most important line is
Len(String:"99999999") returns LONG:8
**This means that the length of the code you entered is checked...
So, I tried 9 characters... "999999999"
Re-run the program and enter "999999999". You will get the error message
again.
Click on the "+" sign next to Command1_Click.
This time, you will see more lines in it with other functions like
Asc and Mid...
So, we are right about the length check.
Under "View" in SmartCheck, choose "Show All Events" and "Show Arguments".
**This is also capture in a file called setting4.jpg file on
http://crackmes.cjb.net or http://surf.to/crackmes
**Make sure you click on Command1_Click first or you will be lost
in a sea of codes!!!
Interesting lines include:
1) Mid$(String:"999999999", long:1, VARIANT:Integer:1)
**This means to get the first char of the code you entered.
2) __vbaVarTstNe(VARIANT:Const Double:9, VARIANT:String:"3")...
where did the "3" come from?? And it is compared to our 1st char "9"
**__vbaVarTstNe means VARiant type data is TeSTed to see if they are
Not Equal
So, we will presume that the first char must be 3.
Choose "Show Errors and Specific Events" under "View" to reduce the
number of lines.
Then, re-run the program and this time, enter "399999999"
Repeat the steps above. you will see even more lines now.
Click on the "+" sign again.
This time, after the 1st __VbaVarTstNe, you will see
Mid$(String:"399999999", long:2, VARIANT:Integer:1)
**It means get the 2nd char which is "9"
Near the end, look for
__vbaVarTstNe(VARIANT:Const Double:9, VARIANT:String:"0")...
Again... a mysterious number "0" appeared.
But you will know that we are on the right track because the 2nd char
is now being compared...
So, repeat the steps above again. Entering "309999999"
**Reminder, make sure you reduce the number of lines first by choosing
"Show Errors and Specific Events" under "View"
Keep doing the same thing for 9 times and you will get this serial...
301674501
Program cracked...
__________________________________________________________________________
Final Notes
This tutorial is dedicated to all the newbies like me. I've tried to
explain everything in details.
And because I'm a newbie myself, I may have explained certain things wrongly
So, if that is the case, please forgive me. Email me if there is anything
you are not clear about.
My thanks and gratitude goes to:-
The Sandman
All the writers of Cracks tutorials