| Target Program: | Quick Heal 3.14 |
| Description: | Quick Heal is a good Virus Scanner. |
| Location: | http://www.quickheal.com
If you prefer a FTP-Search, look for QH514.EXE (3807597 Bytes). |
| Protection: | Unlock-Code |
| Tools needed: | - SoftICE 3.2 |
| Ob duh: | Do
I really have to remind you all that by BUYING and NOT stealing the software
you use will ensure that these software houses will continue to produce
even *better* software for us to use and more importantly, to continue
offering even more challenges to breaking their often weak protection systems.
If you're looking for cracks or serial numbers from these pages then your wasting your time, try to search elsewhere on the Web under Warez, Cracks, etc. |
| Level: | (X)Beginner ( )Intermediate ( )Advanced ( )Expert |
 |
| :0041F192 FF711C
PUSH DWORD PTR [ECX+1C]
:0041F195 FF1564BB4400 CALL [USER32!GetDlgItemTextA] :0041F19B EB0A JMP 0041F1A7 :0041F19D 8B02 MOV EAX,[EDX] |
So after we've returned from the GetDlgItemTextA function (F11), we'll step through the code using the F10-key. We'll jump to 41F1A7. The code at 41F1A7 will look like the following:
| :0041F1A7 5D
POP EBP
:0041F198 C20C00 RET 000C |
Now step forward through the code. Afer you've passed the "RET 00C"-instruction, you'll get the following code:
| :0040A2F0 8D45EC
LEA EAX,[EBP-14]
:0040A2F3 50 PUSH EAX :0040A2F4 E80FC0FFFF CALL 00406308 :0040A2F9 83C404 ADD ESP,00000004 :0040A2FC 8D45D8 LEA EAX,[EBP-28] :0040A2FF 8D4DEC LEA ECX,[EBP-14] :0040A302 50 PUSH EAX :0040A303 51 PUSH ECX :0040A304 E8B1C1FFFF CALL 004064BA :0040A309 83C408 ADD ESP,00000008 :0040A30C 83F801 CMP EAX,00000001 :0040A30F 0F8580000000 JNE 0040A395 |
At 40A2F3 type D EAX to see what's in EAX. Then step over the call (F10). Hey, what's that? EAX has changed it's value to our Installation Number 1111-1111-1111. Ok now at 40A302 look at the value of EAX again. Now EAX contains our enterd Unlock Code and our Installation Number. If you have a look at ECX, you'll find out that it contains our Installation Number. Since there is a "CMP EAX,1"-instruction (check if Unlock-Code is valid) after the "CALL 4064BA", we have to enter this call by pressing F8; if we want to patch Quick Heal 3.14, we would have NOPed out the JNE-instruction. In Quick Heal it would work - but we want to find our Unlock Code. Inside the CALL to 4064BA, you'll find the following code:
| :004064BA 55
PUSH EBP
:004064BB 8BEC MOV EBP,ESP :004064BD 83EC20 SUB ESP,00000020 :004064C0 56 PUSH ESI :004064C1 8D45F4 LEA EAX,[EBP-0C] :004064C4 57 PUSH EDI :004064C5 50 PUSH EAX :004064C6 E84CFDFFFF CALL 00406217 :004064CB 83C404 ADD ESP,00000004 :004064CE 8B7508 MOV ESI,[EBP+08] :004064D1 6A2D PUSH 0000002D :004064D3 56 PUSH ESI :004064D4 E8675B0000 CALL 0040C040 |
At 4064D1 ESI contains our Installation Number. Step over the CALL 0040C040 by pressing F10. You'll see the following code:
| :004064D9 83C408
ADD ESP,00000008
:004064DC 8D7801 LEA EDI,[EAX+01] :004064DF 8D45F4 LEA EAX,[EBP-0C] |
At 4064E2, EDI contains the H-part of the following part of our Installation Number: NNNN-HHNN-NNNN. EAX contains the G-part of the following part of our Installation Number: NNNN-GGGG-GGGG (inclusive the dash).
Since we know this, we can trace forward through the following code:
| :004064E2 6A02
PUSH 00000002
:004064E4 57 PUSH EDI :004064E5 50 PUSH EAX :004064E6 E865650000 CALL 0040CA50 :004064EB 83C40C ADD ESP,0000000C :004064EE 85C0 TEST EAX,EAX :004064F0 7404 JE 004064F6 :004064F2 33C0 XOR EAX,EAX :004064F4 EB54 JMP 0040654A |
As you already know, we can change the Installation Number, which is stored in the registry. The coders from Quick Heal, probably know that a cracker will 'try' to do this and so the check if the Installation Number is valid or if it's invalid. This is done in the CALL 40CA50. The call 40CA50 will use "NOT ECX" (which means, ECX = -1) and "MOV EAX,ECX" if your Installation Number is invalid. So the check at 4064EE will be failed - and you won't jump to 4064F6 - and EAX will then be XORed (4064F2) and then the check at 40A30C will be failed, because when you XOR EAX,EAX then EAX is 0 - and not the needed 1 to pass the test at 40A30C.
So if your Installation Number is valid, you'll see the following code:
| :004064F6 8D45F4
LEA EAX,[EBP-0C]
:004064F9 50 PUSH EAX :004064FA 56 PUSH ESI :004064FB E87CFDFFFF CALL 0040627C |
At, 4064F9 EAX will contain the H-part of the following part of our Installation Number: NNNN-HHNN-NNNN. And at 4064FA, ESI will contain our complete Installation Number. Now step over the CALL by pressing F10 and you'll see the following code:
| :00406500 83C408
ADD ESP,00000008
:00406503 6A2D PUSH 0000002D :00406505 57 PUSH EDI :00406506 E8355B0000 CALL 0040C040 :0040650B 83C408 ADD ESP,00000008 :0040650E 40 INC EAX :0040650F 8D4DF1 LEA ECX,[EBP-0C] :00406512 6A04 PUSH 00000004 :00406514 50 PUSH EAX :00406515 51 PUSH ECX :00406516 E835650000 CALL 0040CA50 :0040651B 83C40C ADD ESP,0000000C :0040651E 85C0 TEST EAX,EAX :00406520 B800000000 MOV EAX,00000000 :00406525 7523 JNE 0040654A |
At 406505, EDI contains the G-part of the following Installation Number: NNNN-GGGG-GGGG (inclusive the dash). Then there's a (not important) CALL. EAX contains at 40650E the L-part of the following Installation Number: NNNN-NNNN-LLLL (inclusive the dash before the first L). Since the dash is unimportant, it is removed by the "INC EAX"-instruction at 40650E. ECX contains at 406512 the L-part of our Installation Number (without the dash). Then it is checked (in the CALL) if EAX and ECX are different. If they are different, the call 40CA50 will use "NOT ECX" (which means, ECX = -1) and "MOV EAX,ECX" - and then you'll fail the check at 40651E. If they aren't different, Quick Heal will continue checking you Unlock Code against the real Unlock Code. So you'll see the following code:
| :00406527 8D45E0
LEA EAX,[EBP-20]
:0040652A 50 PUSH EAX :0040652B 56 PUSH ESI :0040652C E81CFEFFFF CALL 0040634D |
At 40652B, ESI will be the complete Installation Number.
| :00406531 83C408
ADD ESP,00000008
:00406534 8D45E0 LEA EAX,[EBP-20] :00406537 FF750C PUSH [EBP+0C] :0040653A 50 PUSH EAX :0040653B E870590000 CALL 0040BEB0 |
At 406537, EAX will be the real Unlock Code. It looks like NNNN-NNNNNNNN. Write this code down. If you do a D EBP+0C you'll see the Unlock Code you've enterd. So simply press CTRL-D to return to Quick Heal. Now enter the unlock code you've written down. The Unlock Code for the Installation Number 1111-1111-1111 is 3333-11119999. Now Quick Heal is cracked.