home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
Reverse Code Engineering RCE CD +sandman 2000
/
ReverseCodeEngineeringRceCdsandman2000.iso
/
RCE
/
+Sandman
/
Cel_Assebmler.txt
< prev
next >
Wrap
Text File
|
2000-05-25
|
5KB
|
141 lines
How to crack Cel Assembler
Program : Cel Assembler 1.2, is a graphical way to put
together animating GIF files.
Protection : Will expire in 30 days unless you enter a Name + Registration
code.
WWW : http://www.gamani.com/tools/
Tools : Soft-Ice, WS32DASM and a brain
The Cracking Bit
Their are 2 ways of cracking this, the first one is the easiest requiring no knowledge
in assembly language just a bit of thinking. The second part is following the code to
see what happens to the data you entered.
First approach
Step 1 : The first thing I do before I use Soft-Ice is load the exe into WS32DASM.
I do the because I like to look for unusual strings in this case their is
one, but in most cases there isn't.
Step 2 : After you've loaded celasm.exe into WS32DASM do a string search.
Step 3 : After looking at the string data, do you see something weird? Under "KERNEL32"
their is a string data called "LamaLo".
Step 4 : Hmmmm why is LamaLo in, WHAT is LamaLo? I loaded the program up and looked at
the menu to find any reference to do with this word and I couldn't.
Step 5 : So I decided to try something I went to Help, Register Now... I entered :
Name : GrimL0ck [C4n '97]
Reg code : LamaLo
Step 6 : It didn't come up with a text box saying Vaild/Invaild Reg code. So I exited
and reloaded
Step 7 : HEY!!!! Where has the nag screen gone? I tried to reg it again but
when I went to help the option of registering had gone!!!!!!
Step 8 : Click on About and you should see your Name + LamaLo in the box. It's
registered :)
Conclusion :
I decided to try this again, I had to edit my registry (I don't recommend this unless
you know what your doing). I deleted my reg code and re-entered under a different name
but with the same reg code. HEY it worked, so you can put ANY name as long as you put
LamaLo as the code. This is the first time I've seen a static code when you've suppose
to enter a name + code. So it pays to be curious and try things which seem unethical.
Second approach
Step 1 : Load Cel Assembler, goto Help then Register Now.
Step 2 : Enter a name and a reg code I entered GrimL0ck [C4n '97] 12345
DON'T press <Enter> yet.
Step 3 : Press Ctrl D and enter soft-ice
Step 4 : We need to set a breakpoint just after the information has just been read.
So enter :
BPX GetWindowTextA
Step 5 : Get out of sofe-ice with either Ctrl-D, F5 or g
Step 6 : Click on OK to accept the information you've entered
Step 7 : BLAM!!! Your back in soft-ice. The program has just read in your name
Step 8 : Press F5 so your reg code can read in, press F11 to Step of of the function
you should be at the following code :
LEA EAX,[ESP+00000088] <------------- Your Code
LEA ECX,[ESP+24] <------------- Your Name
PUSH EAX
PUSH ECX
CALL 004F950 <------------- Get correct code????
Step 9 : Press F10 a couple of times to step through the program until you reach CALL 004F950
Step 10 : We now want to know what's going to happen at address 004F950. Press CTRL up until you
reach this code :
PUSH ESI
MOV ECX,00000007
MOV EDX,[ESP+0C]
PUSH EDI
MOV EDI,0041D894 <---------------- Hmmm What's been move to 0041D894 ???
MOV ESI,EDX
REPZ CMPSD <---------------- Return back to previous code
Step 10 : Lets find out whats been moved into 0041D894, by entering D 0041D894, in the Data window
you should be able to see the correct code "LamaLo".
Step 11 : Press F10, so the CALL 0041D894 function has been executed you should know be at this
point :
ADD ESP,08 <-------- Erase saved information
TEST EAX,EAX <-------- Check function return (The CALL 004F950)
JZ 0040FDEF <-------- Jump on zero (EAX = 0 Wrong (EAX = <> 0 Correct)
Conclusion :
So if their was some sort of calculation for the code it would probably be stored in 041D894
but I'm not sure, anyway that explains 2 different ways of cracking a program.
That's wraps that up :) I'd just like to thank people on #Cracking4Newbies who without their help
none of this would be possible.
If you need help with anything join #Cracking4Newbies on EfNet
WWW: http://c4n.home.ml.org
GrimL0ck