A Newbie Cracking tutorial useing a live approach on Digisignature Ver 3.0 - By Bisoux ------------------------------------------ this is my first essay so bare with me and my poor inglish ;o) Level : Newbie Tools : Winice ver 3.xx DigiSignature v3.0 URL:http://www.simtel.net/pub/simtelnet/win95/security/sign30.zip Introduction ------------ This Program has 0 security a small patch and it's registered. It didn't take me a very long time and I'm not a Master Cracker. I assume you have Sice installed and running and that u have a basic working knowledge of how to make it work for you, "the cracker". To make this tut more attractive then just a dry description of the cracking process I'll try to explain what is going on.... There will be 2 pahses the first one is for absolute beginners and the second one will just show how easy it to find the real serial and not to do an ugly patch 1.Doing the patch. ------------------ ok enough of bulls let's CRACK! ok run the programe... what do u know an ugly nag screen asking for u to register , let's register , click on the register tab and then the dialog box will pop up. So what do we have here : (I filled it like this but do whatever u want!) Name: Bisoux Company : KAC Serial Num: 123456789 (I always use this since if not all the numbers will be taken in the calculation I'll know in wich position it does) ok before pressing ok buttom let's put some break point on Sice now let me explain here a bite what we are doing exactly since a lot of newbies are doing it without understanding and it's a shame!! we are going to break on a API call , now what's an API ? API stands for Application Programing Interface , that's mean that a lot of internal routines that are done a lot under windblows are offered as standard services by your OS (Operating System) e.g. drawing windows,I/O operations,memory operations etc... But anyway U should get an API refrence if u want to b a cracker.... when standing in a dialogbox (like you are now) the API which windows is useing to put your details in are normally the following : GetDlgItemTextA (without A in 16bit applications) GetWindowTextA and for all input procedures no matter what language used : hmemcpy This last one I use only as last resort because it often gives a "false alert" So know that we understand what we are doing (I hope) lets bpx on the first two API calls mentioned. bpx GetDlgItemTextA bpx GetWindowTextA Now back to our proggie ( ctrl-d ) and press the OK button! Sice will pop saying the reason is GetWindowTextA. That means that our first string is beeing loaded , but remember we have 3 strings that the proggie will read (name,company and serial) so what we want is to start tracing from the 3rd load of string this is why we are going to press twice more F5(=ctrl+d). Gr8 sice poped 2 more times now we r in the middle of GetWindowTextA API call so we'll press F12 to get back to our proggie source. Now the first thing I do when I crack a program is to take a look what is going on, where the the compare and the jumps are. Normally (but not always) the proggie will make some calls which mean that it will perform some function routines and then will come back to do a comparison with a conditional jump afterwards. First time I'm not going to step into all the calls just to see where and why the "Bad Boy" will pop up. So until then what I'll do is double click on every conditional jump i'll see and that will give me a bpx on that line (thanx to Sice and it's mouse support) . now the double click worx only if u had your sice is well configured to suppourt mouse and video driver now I persume u r allready familiar with all that , and if your not a great page about all this is : http://server.kibla.org/lusers/mib/sice.htm (and a great site of knowledge) anyway if u haven't got this possibilty u'll have to do a bpx on the addresse u c as a conditional jump like this : "bpx xxxx:xxxxxxxx ". but if your lazy like me get your mouse and video well configuered. A conditonal jump is the assmebly way to make an "IF" like in any another programming languges.so we must understand that the bad boy window did showed up because it failed a condition. SO continue trcaing useing F10 and double clicking on every single jump u c. Finally the bad boy will apear saying "wrong......" ,kewl normally the last jump or one before here is the final jump and u have all this in sice , great ctrl-d , bl to see the list of all you bpx's with a little numer next to 'bd' all of the except the last one bd 0 1 .... that means breakpoint disable and the advantage is that the location of all the other jumps wan't disapear just be disabeled. Now F5 to continue put in your name etc... press ok and sice will pop on this linge :00408845 8BD8 mov ebx, eax :00408847 FF37 push dword ptr [edi] :00408849 E8C2070000 call 00409010 :0040884E 83C404 add esp, 00000004 :00408851 3BC3 cmp eax, ebx :00408853 7411 je 00408866 <== you'll be here !!!! * Possible Reference to String Resource ID=00016: "Select one of the user ID names in the list at left, or use " | :00408855 6A10 push 00000010 * Possible Reference to String Resource ID=00063: "Error Message" | :00408857 6A3F push 0000003F next to where you'll land there will be a small mention in softice saying (no jump) now what does this means? Evry time that there is a compare or a test in assembly there is a flag wich contains the answer you can see the flag at the top right if your register window in softice is on (if it isn't just do 'wr' and it will pop up) now we would like to to change this right , wich will change the result of the test and make us jump instead... so we're going to use the r command in sice that changes/display the contenets of our register. If u have any problems with sice command just type in "help r" or what ever command you want to figure out and sice will give a small description of it. all that rest to do is change the no jump into jump u do this by typing 'r fl z' wich means toggle the zero flag. Now this will change the (no jump) into (jump) F5 (wich is the same as ctrl-d) and booommmmm!!!!!! Your registred!!! congratulationsa u just cracked another proggie!! now this proggie is has 0 protection beacuse if it had something more elaborated (like most prorams have) it will recheck your serial every time you load it, BUT not this baby!!!! 2.Finding the right code (thanx to MisterE) ------------------------ Now that u know how to patch it you are really close to getting the right code. what has happened the u had : :00408851 3BC3 cmp eax, ebx :00408853 7411 je 00408866 that means a comparison between the registers eax and ebx,now u can do a lot of things here just bpx on 00408851 and you will have the answer but I will like to demonstrate the normal useuel way of finding your correct serial. So first of all unregiter the program , you'll do this by deleting the registery on HKEY_local_machine/softwares/thunderbyte/digisign/code Anyway for cracking u'll have to knoww and undesrtand the registery.... a lot of very good info can be obtained at _mammon's page on: http://www.eccentrica.org/Mammon/ After unregistering run the programme you'll have it like new , register , put your details , get into softice , bpx getwindowtexta (remeber the api call..) get back to the program , push the ok button , and your in soft-ice once again 2 more times f5 (remeber it has to load your 3 strings) f12 to get to your prorame , ok , let's look for our string in memory how ? simple... s 0 l ffffffff '123456789' (or whatevere bougie number you put in) these means s - search from address 0 l-length to ffffffff the string 'Your_String' . sice will answer you: match has been found in xxxx:xxxxxxxx gr8 now we want that evry time the programme will touch thise memory addresse it will tell us (that means break). so will do a bpr wich means break point on range , just like this : bpr xxxx:xxxxxxxx xxxx:xxxxxxxx+9 rw that means bpr from the addresse sice found until the same address plus our string's length , rw means read/write if u r lazy enough like me , u'll find that right clicking on a address and the choosing cut&paste will speed up things and will prevent unwanted copy mistakes. now that u have done this ,f5 to continue the programe , sice will pop up when your string is beeing manipulated , we saw b4 that this do not happen in the principal program but within a call of it so a F12 will get u back to where the call was from u'll land here : :0040883C FF1538404100 Call dword ptr [00414038] :00408842 83C404 add esp, 00000004 <=== u're here :00408845 8BD8 mov ebx, eax :00408847 FF37 push dword ptr [edi] :00408849 E8C2070000 call 00409010 :0040884E 83C404 add esp, 00000004 :00408851 3BC3 cmp eax, ebx :00408853 7411 je 00408866 looks familiar ? sure is now what do u c? eax moved to ebx wich get compared some instructions later.. let do a "d eax" (or right click on it and choose display) this will show us what eax contains . we c nothing bad , let us check what valus it conatins by doing "? eax" this will give 3 values decimal hexadecimal and it's value in ascii. so know u understand what the call is all about it put the value of your string in eax , this is a methode used not to show any echoes in the memory for crackers to look for.... ok we c this value is stored in ebx , not pushed for the next call(I wonder what this call is ;o) ) and then immidatly after the call get compared with eax , will f10 until there type "? ebx" u get your serial ? eax --> bingo your correct serial !!! now disable all the break points get back try it! u have won the jackpot !!! :))) easy no ? Final Words ----------- Now offcourse there r many more ways to crack this baby but in this method u'll do it in no more then 5 minutes , you can try to make a keygenerator now just step into the call 00409010 and figure out what it does or for the newbie try the deadlist methode it will worl easily as well. "Hope you learned something from this" (as someone said b4;) ) and that it will initiate u the newbie to the live approach , soft - ice is a very powerfull weapon that should be fully explored....... If u have any problems with this do not hesitate to contact me on: bisoux10@hotmail.com Thanx ----- Tillety - my aussie brother that corrected my inglish MisterE = great tut writer that helped me with this one Vizion for baring my newbie questions, Quantico,HalVarand all the rest from #C4N a great channel indeed a lot of nice pepole that will help you with any question you have ,so a very big thank you to nIabi ant Mexelite for this great channel of information. MindCrush for asking me to write this. Pj (off course) Tetsuo (the linux expert) for beeing a good friend. Improtant links --------------- Fravia.org --> a must for any cracker GREAT knowledge site!!!! cracking.home.ml.org <--- caligo's page evrything u'll ever need (hope it will not go down soon) from those 2 links u'll discover the wonderfull world of cracking :) Bisoux ------