svcrcrack.zip StreameBox VCR 1.0 BETA 2 Crack (January 1, 2000) |
Part I - StreameBox VCR and Reverse Engineering
StreameBox VCR is a brilliant example of reverse engineering; it will take the address of a real audio file (or in fact a long list of such files), decode them, contact the proper realaudio servers, and (cough cough) bully the server into sending it the raw files which it then saves to your harddrive.
As a historical note, StreameBox VCR used to be a program called "xfilegete," which is available on the web and seems more stable than this beta version of StreameBox VCR, but it does not know how to negotiate with many of the newer realaudio servers, wheras StreameBox VCR does. Be warned that it is still a beta and sometimes crashes. It's also not the easiest program to use, but on the other hand, it's the only program that knows how to reach through space and time and suck the life out of those realaudio streams, so you've got to love it.
Of course RealAudio doesn't want you recording their streams using this program, because they don't want you using another program to access realaudio files, and more importantly don't want you being able to save their real audio streams (it's probably more accurate to say that the stream distributors may not want you to record them, and RealAudio has assured them that they will be protected).
To make a long story short, sometime around 12/7/99, RealAudio was able to obtain an injunction on StreameBox, preventing them from distributing the StreameBox VCR program (www.streamebox.com for more info). It remains to be seen the outcome of this litigation.
I'm not a freedom-of-information fanatic, and I'm not advocating that you use StreameBox VCR or this crack. No information on this page is illegal, but using the original StreameBox VCR program at this time may be. At a minimum it's morally questionable. This crack is provided for informational purposes only. Use it to develop a deeper understanding of the fractal beauty of this situation: RealAudio cracks the sound waves, StreameBox cracks RealAudio, we crack StreameBox. As always, if you use the software, and you can afford it, buy it.
Part II - How to use the crack
Note: This crack is made for StreameBox VCR 1.0 BETA 2; it probably will not work for other versions.
StreameBox VCR has (at least) two places where it tries to phone home to its mommy. The first time is when you run the program for the first time. It asks for user information and then tries to register you. It also stores your user information in the Windows Registry, which is how it decides whether this is your first time running the program. The second is more pernicious.
Every time you want to download a file or realaudio stream, it tries to call home and ask its mommy if it's okay. Theoretically i guess the idea is that the StreameBox server will be able to say no to you if a) you haven't registered your version of the program or b) if the author of the stream doesn't want you to record the stream (hmmm... why would we want this program then?).
As far as I know, the StreameBox server is currently approving all file download
requests. BUT with the injunction against StreameBox, it seems inevitable that
their server will soon be shut down, rendering the uncracked version of this
program inoperable.
Anyway, we can't have that. So run svcrpatch.exe to fix the program from trying
to register you and your download requests. If you are the paranoid type wary
about trojan cracks, or if streambox comes out with a new version that this
crack doesn't work on, read the story below to find out what the crack does
- it's quite trivial really. Thankz go to perfx for the awesome patchfx utility.
Lastly, StreameBox VCR Beta does not come with an install program, you just run the executable from wherever you want. We include a file uninstallsvcr.reg, which won't help you get rid of the executable, but will remove all traces of the program from your registry when you run it. It's just one line, take a look at it.
Part III - Story of the Crack
I am *not* a cracker - it's probably been 15 years since i ran a debugger, and i've tried to forget there was such a thing as assembly language. But there exists a rich subculture of crackers in our midst. It's one of the most beautiful, startling things to discover. We forget about the TMRC and the cryptographers, and the people who cracked the HP41C calculator (old school crackers should learn about them!). These are people who are looking at the insides of the insides of the insides.
Anyway, the crack for this proggie was trivial. It *could* have been made very tricky - any program that can assume an internet connection can be made quite tough to crack, but we got lucky here. So I'll tell you about how the program was cracked for the benefit of the real newbies who are curious. Everyone else can change the channel now. But before i do i want you to search the web for some tutorials by 'the keyboard caper' a cracker who founded the phrozen crew. not to learn from, but to just read the words and enjoy the spirit of this person. there are more sophisticated complex essays on cracking, but i want you to get a feel for how happy these tutorials can make you. at least they did that for me.
Okay here goes the story of the crack, which will be of interest only to a person who has never cracked a program before.
14 bytes Ethernet Header
6 bytes Destination Ethernet Address xx:xx:xx:xx:xx:xx <--- i blacked out address
6 bytes Source Ethernet Address 00:e0:b0:e2:a9:28
2 bytes type 0x800 ( IP )
20 bytes IP Header
4 bits version 4
4 bits header length (longwords) 5
1 byte type of service 0x0
2 bytes total length 40
2 bytes identification 0xce0e
3 bits Fragmentation Flags
1 bit 0 . . - Reserved
1 bit . 1 . - Don't Fragment (DF)
1 bit . . 0 - More Fragments (MF)
13 bits fragment offset 0x0
1 byte time to live 119
1 byte protocol 0x6 ( TCP )
2 bytes header checksum 0x1a89
4 bytes source IP address 216.34.68.140 <------------- the home base
4 bytes destination IP address xx.xx.xx.xx <---------- i blacked out address
Data:
1.1 200 OK
Set-Cookie:
WEBTRENDS_ID=xxx.xxx.xxx.xx-3431x5x304.2x316x51; <--- i blacked out address
expires=Fri, 31-Dec-2010 00:00:00 GMT; <--- looks like we have a while ;)
path=/
Server: Microsoft-IIS/4.0
Date: Sat, 01 Jan 2000 09:08:42 GMT
Pragma: No-Cache
Content-length: 212
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451D7B(C)
|
:00451DAB 837D0805 cmp dword ptr [ebp+08], 00000005
:00451DAF 751E jne 00451DCF
:00451DB1 6A00 push 00000000
:00451DB3 6A00 push 00000000
:00451DB5 8B4D10 mov ecx, dword ptr [ebp+10]
:00451DB8 51 push ecx
:00451DB9 8B550C mov edx, dword ptr [ebp+0C]
:00451DBC 52 push edx
* Possible StringData Ref from Data Obj ->"Access Denied"
|
:00451DBD 68A8DC4C00 push 004CDCA8
:00451DC2 6A01 push 00000001
:00451DC4 E868B0FBFF call 0040CE31
:00451DC9 83C418 add esp, 00000018
:00451DCC 8945F0 mov dword ptr [ebp-10], eax
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00451DAF(C)
|
:00451DCF 837D0806 cmp dword ptr [ebp+08], 00000006
:00451DD3 751D jne 00451DF2
:00451DD5 6A00 push 00000000
:00451DD7 6A00 push 00000000
:00451DD9 6A00 push 00000000
* Possible StringData Ref from Data Obj ->"Sreambox VCR Server Service will "
->"shut down for maintance. After "
->"the server maintance has been "
->"completed, you will be able to "
->"use Sreambox VCR."
|
:00451DDB 68B8DC4C00 push 004CDCB8
0045A6D8 5F pop edi
:0045A6D9 5E pop esi
:0045A6DA 5B pop ebx
:0045A6DB C9 leave
:0045A6DC C22000 ret 0020
:0045A6DF 55 push ebp <----- dissasembler doesn't know how we could get here, me either
:0045A6E0 8BEC mov ebp, esp
:0045A6E2 83EC28 sub esp, 00000028
:0045A6E5 8B4508 mov eax, dword ptr [ebp+08]
:0045A6E8 53 push ebx
:0045A6E9 56 push esi
:0045A6EA 57 push edi
Possible Reference to String Resource ID=00131: "http://216.34.68.140/_vti_bin/go.dll?ID=%s"
|
:004165C2 6883000000 push 00000083
:004165C7 8D4DF0 lea ecx, dword ptr [ebp-10]
:004165CA 51 push ecx
:004165CB E8B02C0600 call 00479280
* Referenced by a CALL at Addresses:
|:00412317 , :00414D7D , :00414EEA , :00417753 , :004178C0
|:004310F3 , :00431260 , :00434316 , :0043E155 <--- look at all the places that calls this
|
:0043CC49 55 push ebp <----------- here's the start
:0043CC4A 8BEC mov ebp, esp
:0043CC4C 51 push ecx
:0043CC4D 894DFC mov dword ptr [ebp-04], ecx
:0043CC50 8B45FC mov eax, dword ptr [ebp-04]
:0043CC53 83B8EC00000000 cmp dword ptr [eax+000000EC], 00000000
:0043CC5A 7407 je 0043CC63
:0043CC5C B801000000 mov eax, 00000001
:0043CC61 EB2F jmp 0043CC92
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CC5A(C)
|
:0043CC63 8B4DFC mov ecx, dword ptr [ebp-04]
:0043CC66 51 push ecx
:0043CC67 8B4DFC mov ecx, dword ptr [ebp-04]
:0043CC6A 81C1A4000000 add ecx, 000000A4
:0043CC70 E82B5B0000 call 004427A0
:0043CC75 50 push eax
:0043CC76 B9B00C4D00 mov ecx, 004D0CB0
:0043CC7B E8B396FDFF call 00416333
:0043CC80 8B55FC mov edx, dword ptr [ebp-04]
:0043CC83 8982EC000000 mov dword ptr [edx+000000EC], eax
:0043CC89 8B45FC mov eax, dword ptr [ebp-04]
:0043CC8C 8B80EC000000 mov eax, dword ptr [eax+000000EC]
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0043CC61(U)
|
:0043CC92 8BE5 mov esp, ebp
:0043CC94 5D pop ebp
:0043CC95 C3 ret <------- and here's the finish
* Referenced by a CALL at Addresses:
|:00412317 , :00414D7D , :00414EEA , :00417753 , :004178C0
|:004310F3 , :00431260 , :00434316 , :0043E155 <--- look at all the places that calls this
|
:0043CC49 C3 ret <----------- this used to say PUSH ebp
:0043CC4A 8BEC mov ebp, esp
:0043CC4C 51 push ecx
:0043CC4D 894DFC mov dword ptr [ebp-04], ecx
:0043CC50 8B45FC mov eax, dword ptr [ebp-04]
:0043CC53 83B8EC00000000 cmp dword ptr [eax+000000EC], 00000000
:0043CC5A 7407 je 0043CC63
:0043CC5C B801000000 mov eax, 00000001
:0043CC61 EB2F jmp 0043CC92
:00416E9C 55 push ebp
:00416E9D 8BEC mov ebp, esp
:00416E9F 6AFF push FFFFFFFF
:00416EA1 6864104A00 push 004A1064
:00416EA6 64A100000000 mov eax, dword ptr fs:[00000000]
:00416EAC 50 push eax
...
:00416F7F 5D pop ebp
:00416F80 C20400 ret 0004 <----- here's the return from the call
That's it, probably not of much practical value to you newbies like me, but maybe it will show you what you can accomplish in an evening with some luck and perseverence, even if your skills are extremely limited like mine; and don't underestimate the amazing feeling you'll get the first time you make it to the bitch's nest.
If you're interested in recording realaudio streams you might also want to check out http://www.phase-one.com.au/fravia/soucli_1.htm, which talks about a different method involving cracking realplayer to get it to let you record streams as you listen to them.
Part IV - Download
The crack is available here: svcr1b2crack.zip.