Reverse Code Engineering RCE CD +sandman 2000/ReverseCodeEngineeringRceCdsandman2000.iso/RCE/Quantico/km/dao31e.asm.txt

Text File | 2000-05-25 | 9.2 KB | 269 lines

;-----------------------------------------------------------------------------

; 100% keygenerator for CDR-Win 3.1e/DAO 16/32 3.1e

; coded 06/26/97

; full credits go to the guy who localised the hidden check.

; do_what_you_want_with_it_source

; compile : tasm dao31e-k

;           tlink /t /3 dao31e-k

;-----------------------------------------------------------------------------



; some notes on the registration check by the guy mentioned above ;)

;

; the registration algorithm works this way:

; 1.1 compute 32 bit hash value from user name (must be at least 6 chars)

; 1.2 swap upper and lower 16 bits of this hash value

; 1.3 compute 32 bit hash value from company name (must be at least 6 chars)

; 1.4 XOR 32 bit numbers computed in step.1.2 and step.1.3 with each other

; 1.5 convert registration number (which is an ascii string) to a 32 bit number

;     by calling atol() (this is a C library function)

; 1.6 compare 24 bits of the two numbers we got in step.1.4 and step.1.5

; 1.7 if they match (in those 24 bit positions) then accept registration

;

; wow, now we know how to compute the registration number!

;

; well, at least this is what all crackers thought when they were tracing

; through the registration code. it seems that nobody had a second thought

; about the fact that only 24 bits were checked/compared, 8 bits were simply

; ignored, thus making key generators where those 8 bits were chosen randomly

; (usually taken from the number computed in step.1.4)

;

; however, later people noticed that certain types of CDs were fucked up

; 'cos apparently some random data was written into some sectors (which

; made the CD unusable). rumour went around stating that there was a second

; or hidden check in the program.

;

; well, as you probably found out by now this hidden check does exist indeed!

; to find it i used IDA, probably one of the best disassemblers ever made.

; (i didn't use WINICE at all)

;

; this is how i approached the problem: first, i had to find out what those

; 24 bits were that were checked during registration. this was easy, however

; i'd like to point out that the checking algorithm is extremly lame (well,

; maybe it was intentional to confuse the crackers) 'cos instead of using

; a bitmask to mask out the uninteresting 8 bits and then doing a simple cmp,

; the author wrote a for loop in which he compared 24 of 32 bits, one by one.

;

; the bits to be compared were determined by a table of 32 entries, where each

; entry (a 0 or 1) corresponded to a bit position, namely a 1 caused a bit

; position to be compared (i.e. there are 24 1s and 8 0s in that table).

; btw, the effective bitmask in the comparison is 0xFB39DEBF.

;

; after learning this, i assumed that in the hidden check only the remaining

; 8 bits were checked, either by using the table of 1s and 0s mentioned above

; (which was not the case, as IDA didn't find any more references to it) or

; by using the more effective masking method (which turned out to be the case).

;

; now, the masking method basically could have been implemented in two ways:

; either using 0xFB39DEBF or its binary complement 0x04C62140. a quick search

; revealed that the first value was used, as it was stored in the data area

; of the program (you can find it in the executable if you search for it).

; now, all i had to do was to find the code that referenced this value (which

; IDA did for me automatically) and see how it was used.

;

; so, the hidden check works this way:

;

; 2.1 read 0xFB39DEBF from the data area and then NOT it

; 2.2 AND the registration number and the mask computed in step.2.1

; 2.3 substract 0x822040 from the number computed in step.2.2

; 2.4 if the result is not zero, then set a variable to 0x930 in the data area

; 2.5 later, during burning, check whether that variable mentioned in the

;     previous step is equal to 0x930 or not. if it is then write some random

;     data into the current sector being written

;

; so, all we have to make sure is that the substraction done in step.2.3 will

; result in 0 (in this case that memory variable will contain a 0 by default).

; i guess, from this point on it is very trivial what those 8 bits have to be

; set to. if not then have a look at the code below ;).

;-----------------------------------------------------------------------------



.model tiny

.code

.386

org 100h

main:



        push cs

        pop ds

        mov dx,offset(presentation)

        mov ah,09h

        int 21h



        mov ah,0ah

        mov dx,offset(keyb_buffer)

        int 21h



        cmp byte ptr [string_length],06h

        jb not_enough_char_4_name



        mov esi,offset(DAO_REG_TABLE)

        call magic_num_calc

        push eax



        mov esi,offset(CDRWIN_REG_TABLE)

        call magic_num_calc



        rol eax,10h

        mov dword ptr [offset(magic1)],eax



        mov dx,offset(ask_company)

        mov ah,09h

        int 21h



        mov ah,0ah

        mov dx,offset(keyb_buffer)

        int 21h



        cmp byte ptr [string_length],06h

        jb not_enough_char_4_company



        mov esi,offset(DAO_REG_TABLE)

        call magic_num_calc

        push eax



        mov esi,offset(CDRWIN_REG_TABLE)

        call magic_num_calc

        xor eax,dword ptr [offset(magic1)]



;------------Fixing Calculated key in order to make it real-----------

        and eax,0FB39DEBFh

        or  eax,00822040h

;---------------------------------------------------------------------



        mov bx,offset(CDRWIN31eRegCode)+9

        call hex2dec



        mov ah,09h

        mov dx,offset(HereisCDRWIN31e)

        int 21h



        pop ebx

        pop eax

        rol eax,10h

        xor eax,ebx

;------------Fixing Calculated key in order to make it real-----------

        and eax,0FB39DEBFh

        or  eax,00822040h

;---------------------------------------------------------------------



        mov bx,offset(DAO31eRegCode)+9

        call hex2dec



        mov ah,09h

        mov dx,offset(HereisDAO31e)

        int 21h



prog_ends_ok:

        mov ax,4C00h

        int 21h



hex2dec proc near

        mov ecx,000ah

        xor edx,edx

        div ecx

        add dl,30h

        mov [BX],dl

        dec bx

        or eax,eax

        jnz hex2dec



        ret

        endp



not_enough_char_4_name:

        mov dx,offset(toofew4name)

        jmp print_error

not_enough_char_4_company:

        mov dx,offset(toofew4cie)

print_error:

        mov ah,09h

        int 21h

        mov ax,4Cffh

        int 21h



MAGIC_NUM_CALC PROC NEAR

        xor eax,eax

        mov ebx,offset(string)



        push word ptr string_length

keep_calc:

        xor edx,edx

        mov DL,[EBX]

        INC EBX

        mov ECX,EDX

        shr edx,02h

        xor ecx,eax

        shr eax,04h

        and ecx,0000000fh

        mov ecx,[ecx*4+esi]

        xor ecx,eax

        lea eax,[ecx*4+0]

        shr ecx,04h

        xor eax,edx

        and eax,3ch

        mov eax,[esi+eax]

        xor eax,ecx

        DEC byte ptr [offset(string_length)]

        jnz keep_calc

        pop word ptr string_length

        ret

        endp



CDRWIN_REG_TABLE:

        DB 000h,000h,000h,000h,07Eh,088h,03Eh,01Ch,0FCh,010h,07Dh,038h,082h,098h,043h,024h

        DB 0F8h,021h,0FAh,070h,086h,0A9h,0C4h,06Ch,004h,031h,087h,048h,07Ah,0B9h,0B9h,054h

        DB 0F0h,043h,0F4h,0E1h,08Eh,0CBh,0CAh,0FDh,00Ch,053h,089h,0D9h,072h,0DBh,0B7h,0C5h

        DB 008h,062h,00Eh,091h,076h,0EAh,030h,08Dh,0F4h,072h,073h,0A9h,08Ah,0FAh,04Dh,0B5h



DAO_REG_TABLE:

        DB 000h,000h,000h,000h,0C0h,0ADh,055h,019h,080h,05Bh,0ABh,032h,040h,0F6h,0FEh,02Bh

        DB 000h,0B7h,056h,065h,0C0h,01Ah,003h,07Ch,080h,0ECh,0FDh,057h,040h,041h,0A8h,04Eh

        DB 000h,06Eh,0ADh,0CAh,0C0h,0C3h,0F8h,0D3h,080h,035h,006h,0F8h,040h,098h,053h,0E1h

        DB 000h,0D9h,0FBh,0AFh,0C0h,074h,0AEh,0B6h,080h,082h,050h,09Dh,040h,02Fh,005h,084h



magic1: DB 00h,00h,00h,00h



presentation:

        DB 0ah,0dh

        DB ' 100% Key-Generator for DAO 3.1e/CDR-Win 3.1e, hidden check supported 26-06-97',0ah,0dh

        DB ' ---[Brought to you by #cracking]---------------------------------------------',0ah,0dh,0ah,0dh

        DB ' Produces original keys, you won''t fuck CDs with it! CDRWIN/DAO both tested.',0ah,0dh

        DB ' Thanks to Midi-Man for testing with his rewritable.',0ah,0dh,0ah,0dh



ask_name:

        DB 'Enter your name (min 6 char): $'



ask_company:

        DB 0ah,0dh

        DB 'Enter your company (min 6 char): $'



toofew4name:

        DB 0dh,0ah,0dh,0ah

        DB 'At least 6 characters for name needed$'



toofew4cie:

        DB 0dh,0ah,0dh,0ah

        DB 'At least 6 characters for company needed$'



HereisCDRWIN31e:

        DB 0dh,0ah,0dh,0ah

        DB 'CDRWIN 3.1e : '



CDRWIN31eRegCode:

        db '          $'



HereisDAO31e:

        DB 0dh,0ah

        DB 'DAO 3.1e    : '



DAO31eRegCode:

        db '          $'



keyb_buffer:

        DB 80h

string_length:

        DB 00h

string:

        end     main