Cracking 101

home *** CD-ROM | disk | FTP | other *** search

/ Cracking 101 / C101-90.003 < prev next >

Wrap

Text File | 1990-01-01 | 14.8 KB | 400 lines

CRACKING 101 - 1990 edition Lesson 3 ┌─────────────────────────────────────┐ │ CHAMBER OF THE SCI-MUTANT PREISTEST │ └─────────────────────────────────────┘ Oh shit, I have finally found a newer program that has on disk copy protection. Good, you'all need a refresher course on so here it is (YO JB study hard, you might learn something). CHAMBER of the SCI-MUTANT PREISTEST (CSMP) is a really fucked up game but was simple to unprotect. So, lets dive right in. We will be using DEBUG here (although I used periscope but then shit I'm special) to do the crack. Lets dive in. When we first load CSMP (the file ERE.COM) and unassemble it here is what we get. u 100 10B 119A:0100 8CCA MOV DX,CS 119A:0102 81C2C101 ADD DX,01C1 119A:0106 52 PUSH DX 119A:0107 BA0F00 MOV DX,000F 119A:010A 52 PUSH DX 119A:010B CB RETF I included the register listing for a reason. NOTICE that this piece of code just seem to stop (the RETF) statement. Well, what is really does is place the address (segment and offset) of the real starting point on to the stack and the execute a far return to that location. Now this might fool a real beginner (or at least make him worry a bit but us...no way). If you take the current CS value and add 1C1 to it (in segment addition) you will get the segment address 135B (that is if you are using my example of 119A. If not then you will not get 135B but trust me, it's the right value). So since we want to be at the real program, execute the code until 10B (ie use the command "G 10B") then trace through the next instruction. If you now unassemble the code, here is what it should look like. -u 000f 36 135B:000F 9C PUSHF 135B:0010 50 PUSH AX 135B:0011 1E PUSH DS 135B:0012 06 PUSH ES 135B:0013 0E PUSH CS 135B:0014 1F POP DS 135B:0015 0E PUSH CS 135B:0016 07 POP ES 135B:0017 FC CLD 135B:0018 89260B00 MOV [000B],SP 135B:001C C70600000102 MOV WORD PTR [0000],0201 135B:0022 B013 MOV AL,13 135B:0024 A23500 MOV [0035],AL 135B:0027 A2FF01 MOV [01FF],AL 135B:002A A22F02 MOV [022F],AL 135B:002D A23901 MOV [0139],AL 135B:0030 B280 MOV DL,80 135B:0032 B408 MOV AH,08 135B:0034 CD21 INT 21 135B:0036 7232 JB 006A Since we are looking for a disk based copy protection, it might be a good time to look for INT 13. So search the current segment for INT 13 with the command S 135B:0 FFFF CD 13 But shit, nothing. You mean this program doesn't use int 13. Be real. Reread the first lesson. You know the one that talks about self modifing code. This is what we have here. Let's take a closer look at the last bit of code but this time, with my comments added. -u 000f 36 ; The first part of the code simple sets up for the return to ; dos as well as sets ES and DS 135B:000F 9C PUSHF 135B:0010 50 PUSH AX 135B:0011 1E PUSH DS 135B:0012 06 PUSH ES 135B:0013 0E PUSH CS 135B:0014 1F POP DS ; Set DS to CS 135B:0015 0E PUSH CS 135B:0016 07 POP ES ; Set ES to DS 135B:0017 FC CLD 135B:0018 89260B00 MOV [000B],SP ; The next instruction sets up a variable that is used in the ; routine that reads in the sectors from the disk. More on ; later. 135B:001C C70600000102 MOV WORD PTR [0000],0201 ; Now, here is the self modifing code. Notice at AL is 13 ; (INT 13h ... Get it). Look at the first memory location ; (35h) and remember that DS = CS. With this in mind, when ; then instuction at 135B:0024 is executed byte at 135B:0035 ; will be changed to 13h. That will in fact change the ; INT 21h at 135B:0034 to an INT 13h. And so on, and so on. 135B:0022 B013 MOV AL,13 ; New value 135B:0024 A23500 MOV [0035],AL ; Change to INT 13h 135B:0027 A2FF01 MOV [01FF],AL ; Change to INT 13h 135B:002A A22F02 MOV [022F],AL ; Change to INT 13h 135B:002D A23901 MOV [0139],AL ; Change to INT 13h ; If you lookup DOS function 08 you will find it's CONSOLE ; INPUT. Now does that seem out of place to you. 135B:0030 B280 MOV DL,80 135B:0032 B408 MOV AH,08 135B:0034 CD21 INT 21 ; Changed to INT 13h 135B:0036 7232 JB 006A Whoa, that was tricky. If you execute up to 135B:30 here is what it should look like.. 135B:0030 B280 MOV DL,80 135B:0032 B408 MOV AH,08 135B:0034 CD13 INT 13 135B:0036 7232 JB 006A AHA, now we are getting somewhere. If we lookup what disk function 08 means, you won't be suprised. Function 08h is GET DRIVE TYPE. It will tell what type of disk drive we have. Remember, if you are loading off of a hard disk then it wants to use a different routine. Since we want it to think we are loading off of disk, then we want to take this jump. So for now, force the jmp by setting IP to 6A. At 135B:006A you find another jmp instruction 135B:006A EB6B JMP 00D7 This jumps to the routine that does the actual disk check. Here is the outer loop of that code (With my comments of course). ; This first part of this routine simply test to see how many ; disk drives you have. 135B:00D7 CD11 INT 11 135B:00D9 25C000 AND AX,00C0 135B:00DC B106 MOV CL,06 135B:00DE D3E8 SHR AX,CL 135B:00E0 FEC0 INC AL 135B:00E2 FEC0 INC AL 135B:00E4 A20200 MOV [0002],AL ; Next, so setup for the actual disk check 135B:00E7 C606090000 MOV BYTE PTR [0009],00 135B:00EC B9F127 MOV CX,27F1 135B:00EF 8BE9 MOV BP,CX 135B:00F1 B107 MOV CL,07 135B:00F3 F8 CLC ; This calls the protection routine part 1 135B:00F4 E82F00 CALL 0126 135B:00F7 B9DE27 MOV CX,27DE 135B:00FA 8BE9 MOV BP,CX 135B:00FC B108 MOV CL,08 135B:00FE F9 STC ; This calls the protection routine part 2 135B:00FF E82400 CALL 0126 135B:0102 8D1E5802 LEA BX,[0258] 135B:0106 8D361C01 LEA SI,[011C] 135B:010A 8BCD MOV CX,BP 135B:010C AC LODSB 135B:010D 8AC8 MOV CL,AL ; This calls the protection routine part 3 135B:010F E8E300 CALL 01F5 ; Makes the final check 135B:0112 7271 JB 0185 135B:0114 AC LODSB 135B:0115 0AC0 OR AL,AL 135B:0117 75F4 JNZ 010D ; If not correct, try again 135B:0119 EB77 JMP 0192 ; Correct, continue program 135B:011B 90 NOP There are calls to 2 different subroutines. The routine at 126 and the routine at 1F5. If you examine the routine at 126 you find that it makes several calls to the routine at 1F5. Then you you examine the routine at 1F5 you see the actual call to INT 13. Here is the code for both routine with comments ; First, it sets up the sector, head and drive information. ; DS:000A holds the sector to read 135B:0126 880E0A00 MOV [000A],CL 135B:012A 8A160900 MOV DL,[0009] 135B:012E B600 MOV DH,00 ; Sets the DTA 135B:0130 8D365802 LEA SI,[0258] 135B:0134 7213 JB 0149 ; Resets the disk 135B:0136 33C0 XOR AX,AX 135B:0138 CD13 INT 13 ; Calls the the check 135B:013A B90114 MOV CX,1401 ; TRACK 14 sector 1 135B:013D 8BDE MOV BX,SI 135B:013F E8B300 CALL 01F5 ; The next track/sector to read in is stored in BP 135B:0142 8BCD MOV CX,BP 135B:0144 E8AE00 CALL 01F5 135B:0147 7234 JB 017D ; If an error occured, ; trap it. 135B:0149 88160900 MOV [0009],DL ; Reset drive 135B:014D 8A0E0A00 MOV CL,[000A] ; reset sector 135B:0151 E8A100 CALL 01F5 ; check protection 135B:0154 722F JB 0185 ; Check for an error 135B:0156 8D5C20 LEA BX,[SI+20] 135B:0159 8BCD MOV CX,BP ; Get next T/S 135B:015B B010 MOV AL,10 ; Ignore this 135B:015D E89500 CALL 01F5 ; Check protection 135B:0160 7223 JB 0185 ; check for error ; The next sector of code checks to see if what was read in ; is the actual protected tracks ; First check 135B:0162 8DBCAC00 LEA DI,[SI+00AC] 135B:0166 B91000 MOV CX,0010 135B:0169 F3 REPZ 135B:016A A7 CMPSW ; NOTE: If it was a bad track, it will jmp to 185. A good ; read should just continue 135B:016B 7518 JNZ 0185 ; Second check 135B:016D 8D365802 LEA SI,[0258] 135B:0171 8D3E3702 LEA DI,[0237] 135B:0175 B90400 MOV CX,0004 135B:0178 F3 REPZ 135B:0179 A7 CMPSW ; see NOTE above 135B:017A 7509 JNZ 0185 ; This exit back to the main routine. 135B:017C C3 RET ; Here is the start of the error trap routines. Basicly what ; they do is check an error count. If it's not 0 then it ; retries everything. If it is 0 then it exit back to dos. 135B:017D FEC2 INC DL 135B:017F 3A160200 CMP DL,[0002] 135B:0183 72B1 JB 0136 135B:0185 E85400 CALL 01DC 135B:0188 8B260B00 MOV SP,[000B] 135B:018C 2BC9 SUB CX,CX 135B:018E 58 POP AX 135B:018F 50 PUSH AX 135B:0190 EB1F JMP 01B1 ** Here is the actual code the does the check ** ; ES:BX points to the buffer 135B:01F5 1E PUSH DS 135B:01F6 07 POP ES ; SI is set to the # of retries 135B:01F7 56 PUSH SI 135B:01F8 BE0600 MOV SI,0006 ; Remember how I said we would use what was in DS:0000 later. ; well, here is where you use it. It loads in the FUNCTION ; and # of sectors from what is stored in DS:0000. This is ; just a trick to make the int 13 call more vague. 135B:01FB A10000 MOV AX,[0000] 135B:01FE CD13 INT 13 ; If there is no errors, then exit this part of the loop 135B:0200 7309 JNB 020B 135B:0202 F6C480 TEST AH,80 ; Check to see if it was a drive TIMEOUT. If so, then set ; an error flag and exit 135B:0205 7503 JNZ 020A ; It must have been a load error. Retry 6 times 135B:0207 4E DEC SI 135B:0208 75F1 JNZ 01FB ; Set the error flag 135B:020A F9 STC ; restore SI and return 135B:020B 5E POP SI 135B:020C C3 RET If you follow through all of that. You will see that the only real way out is the jmp to "135B:0192" at 135B:0119. So, how do we test it. Simple. Exit back to dos and let's add a temporary patch. Reload ERE.COM under debug. Execute the program setting a breakpoint at 135B:0022 (if you remember, that is right at the begining of the self modifing code). When execution stops, change you IP register to 192. Now execute the code. Well shit, we are at the main menu. We just bypassed the entire protection routine. So, now where to add the patch. We will be adding the patch at 135B:0022. But what should the patch be. In this case, simply jumping to 135B:0192 will do. So, reload ERE.COM under debug. Execute the code until 135B:0022. Now unassemble it. Here is the code fragment we need. 135B:0022 B013 MOV AL,13 135B:0024 A23500 MOV [0035],AL 135B:0027 A2FF01 MOV [01FF],AL 135B:002A A22F02 MOV [022F],AL 135B:002D A23901 MOV [0139],AL Here is the code we want to use as the patch 135B:0022 E96D01 JMP 192 So, to add the patch, we search the file ERE.COM using PC-TOOLS. For our search string we use B0 13 A2 35 00 A2 FF 01 A2 2F 02 A2 39 01 PC-TOOLS should find the search string at reletive sector #13. Edit the sector and change "B0 13 A2" to "E9 6D 01" (our patch) and save the sector. BOOM! your done and CSMP is cracked. Fun huh. You just kicked 5 seconds off of the load time. Preaty fucken good. Well, I hope this textfile helped. -Buckaroo Banzai -Cracking Guru