home *** CD-ROM | disk | FTP | other *** search
/ Reverse Code Engineering RCE CD +sandman 2000 / ReverseCodeEngineeringRceCdsandman2000.iso / RCE / +Sandman / c4n-universel.txt < prev    next >
Text File  |  2000-05-25  |  7KB  |  171 lines
  1. How to crack Universe v1.5b
  2. A tutorial by Plushmm
  3.  
  4.  
  5. I don't usually take requests (this crack was requested) but since a friend, DiTTo, has seek my help on this, I decided to take a look at it.
  6.  
  7. Frankly, I found nothing special, the protection used is standard, no big surprises or anything like that AT ALL.  The only thing perhaps worth mentioning is that the author has been careful not to "echo" the correct key in memory.  Instead, he used another (basic) trick for the (essential) comparing of your input key and the correct key.
  8.  
  9. I've also decided to recommend this program as app/week for the week starting 25 Aug 97 at #cracking4newbies.  The prez, Joe, says there's no way newbies can handle this one, and so its has become the op's app/week.  Some ops have tired and failed...I hope that by the end of the week, all the ops can crack it, using the sERIAL I provided as a "hint" to cracking it.
  10.  
  11. You can get the target found:  http://www.diardsoftware.com/
  12.  
  13. Here we go:
  14.  
  15. Run the program and choose to register:  
  16. Enter any crappy info, lets say for the name we use     "Plushmm [PC97]"
  17.             and for the key we use        "1234567"
  18.  
  19. A messagebox so kindly pops up and tells us
  20. "The registration information you supplied is incorrect."
  21.  
  22. Lets deadlist the program and search for this...
  23.  
  24. * Possible Reference to String Resource ID=00001: "Globular Cluster Properties"
  25.                                   |
  26. :00419FF5 6A01                    push 00000001
  27. :00419FF7 E82A8F0100              call 00432F26
  28. :00419FFC 8B8798000000            mov eax, dword ptr [edi+00000098]
  29. :0041A002 B9F87A4600              mov ecx, 00467AF8
  30. :0041A007 50                      push eax
  31. :0041A008 56                      push esi
  32. :0041A009 E8A2030000              call 0041A3B0        ;check reg routine
  33. :0041A00E 85C0                    test eax, eax
  34. :0041A010 744C                    je 0041A05E        ;if 0 then <>regged
  35. :0041A012 8B8798000000            mov eax, dword ptr [edi+00000098]
  36. :0041A018 50                      push eax
  37. :0041A019 83EC04                  sub esp, 00000004
  38. :0041A01C 8965F0                  mov dword ptr [ebp-10], esp
  39. :0041A01F 56                      push esi
  40. :0041A020 8B4DF0                  mov ecx, dword ptr [ebp-10]
  41. :0041A023 E827A90100              call 0043494F
  42. :0041A028 C745FC00000000          mov [ebp-04], 00000000
  43. :0041A02F C745FCFFFFFFFF          mov [ebp-04], FFFFFFFF
  44. :0041A036 B9F87A4600              mov ecx, 00467AF8
  45. :0041A03B E8C0020000              call 0041A300
  46. :0041A040 B9F87A4600              mov ecx, 00467AF8
  47. :0041A045 E826010000              call 0041A170
  48. :0041A04A EB20                    jmp 0041A06C
  49. :0041A04C B890F64500              mov eax, 0045F690
  50. :0041A051 E91A1A0000              jmp 0041BA70
  51. :0041A056 8B4DF0                  mov ecx, dword ptr [ebp-10]
  52. :0041A059 E940AA0100              jmp 00434A9E
  53.  
  54. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  55. |:0041A010(C)
  56. |
  57. :0041A05E 6AFF                    push FFFFFFFF
  58. :0041A060 6A30                    push 00000030
  59.  
  60. * Possible Reference to String Resource ID=01025: "The registration information you supplied is incorrect.   Th"            ;HERE
  61.                                   |
  62. :0041A062 6801040000              push 00000401
  63. :0041A067 E82F3E0200              call 0043DE9B
  64.  
  65.  
  66. Lets look into the Check Reg Routine...
  67.  
  68. * Referenced by a CALL at Addresses:
  69. |:0041A009   , :0041A2A8                   ;called twice!
  70. |
  71. :0041A3B0 53                      push ebx        ;This routine
  72. :0041A3B1 56                      push esi        ;converts your
  73. :0041A3B2 57                      push edi        ;string key into
  74. :0041A3B3 8BF1                    mov esi, ecx        ;a hex value which
  75. :0041A3B5 55                      push ebp        ;is stored at
  76. :0041A3B6 33FF                    xor edi, edi        ;EDI (see :0041A40A)
  77. :0041A3B8 33DB                    xor ebx, ebx        ;Also your name gets
  78. :0041A3BA 8B442414                mov eax, dword ptr [esp+14]    ;played
  79. :0041A3BE 8B08                    mov ecx, dword ptr [eax]    ;around
  80.  
  81. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  82. |:0041A3E8(U)
  83. |
  84. :0041A3C0 3B59F8                  cmp ebx, dword ptr [ecx-08]
  85. :0041A3C3 7D25                    jge 0041A3EA
  86. :0041A3C5 0FBE2C19                movsx ebp, byte ptr [ecx+ebx]
  87. :0041A3C9 03FD                    add edi, ebp
  88. :0041A3CB 8BC3                    mov eax, ebx
  89. :0041A3CD 99                      cdq
  90. :0041A3CE 33C2                    xor eax, edx
  91. :0041A3D0 2BC2                    sub eax, edx
  92. :0041A3D2 83E001                  and eax, 00000001
  93. :0041A3D5 33C2                    xor eax, edx
  94. :0041A3D7 2BC2                    sub eax, edx
  95. :0041A3D9 83F801                  cmp eax, 00000001
  96. :0041A3DC 1BC0                    sbb eax, eax
  97. :0041A3DE 43                      inc ebx
  98. :0041A3DF 83E002                  and eax, 00000002
  99. :0041A3E2 48                      dec eax
  100. :0041A3E3 0FAFE8                  imul ebp, eax
  101. :0041A3E6 03FD                    add edi, ebp
  102. :0041A3E8 EBD6                    jmp 0041A3C0
  103.  
  104. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  105. |:0041A3C3(C)
  106. |
  107. :0041A3EA 8BC7                    mov eax, edi
  108. :0041A3EC 0FAFC7                  imul eax, edi
  109. :0041A3EF 03C7                    add eax, edi
  110. :0041A3F1 33FF                    xor edi, edi
  111. :0041A3F3 50                      push eax
  112. :0041A3F4 E827D7FEFF              call 00407B20
  113. :0041A3F9 83C404                  add esp, 00000004
  114. :0041A3FC 393E                    cmp dword ptr [esi], edi
  115. :0041A3FE 7E0A                    jle 0041A40A
  116.  
  117. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  118. |:0041A408(C)
  119. |
  120. :0041A400 47                      inc edi
  121. :0041A401 E83AD7FEFF              call 00407B40
  122. :0041A406 393E                    cmp dword ptr [esi], edi
  123. :0041A408 7FF6                    jg 0041A400
  124.  
  125. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  126. |:0041A3FE(C)
  127. |
  128. :0041A40A 8B7C2418                mov edi, dword ptr [esp+18]    ;your code
  129. :0041A40E 85FF                    test edi, edi            ;is empty?
  130. :0041A410 7F03                    jg 0041A415
  131. :0041A412 8B7E10                  mov edi, dword ptr [esi+10]
  132.  
  133. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  134. |:0041A410(C)
  135. |
  136. :0041A415 E826D7FEFF              call 00407B40        ;this call to "get"
  137.                             ;the correct key for
  138.                             ;your name (in hex)
  139.                             ;eax = correct code
  140.                             ;edi = your code
  141. :0041A41A 2BC7                    sub eax, edi        ;if eax-edi = 0
  142.                             ;then CORRECT!
  143. :0041A41C 5D                      pop ebp
  144. :0041A41D 5F                      pop edi
  145. :0041A41E 83F801                  cmp eax, 00000001
  146. :0041A421 1BC0                    sbb eax, eax        ;if eax = 0 then
  147.                             ;eax := -1
  148.                             ;else eax := 0
  149. :0041A423 5E                      pop esi
  150. :0041A424 F7D8                    neg eax        ;if eax = -1 then
  151.                             ;eax := 1
  152.                             ;else eax = 0
  153.                             ;
  154. :0041A426 5B                      pop ebx
  155. :0041A427 C20800                  ret 0008
  156.  
  157.  
  158. So what do we have here?
  159.  
  160. EDI = your code in hex,
  161. EAX = correct code in hex
  162.  
  163. If CORRECT then at the end before the return, eax = 1, and thus 
  164. :0041A00E 85C0                    test eax, eax
  165. :0041A010 744C                    je 0041A05E        ;is 0 then <>regged
  166. will not jump since eax = 1
  167.  
  168. So if you bpx at cs:0041A41A and do a "? eax" the correct key will be shown to you!
  169.  
  170.  
  171. Plushmm