This is a tut,which will guide you trough id crackme #6.The main aim is
not to break the registration check,but to unpack it manually.TORN@DO hasn't used only one packer,so this will get a quite long tut.I will try to cut the unimportant things.
We will use a method explained to me by MIZ :D.By using the symbol loader, we will break at the beginning of the first unpacker routine,then wait till it jumps to either eax or ebx,then we wφll dump the memory to an executable file using the dumpfunction of procdump.
The advantage of this approach is,that you don't have to know what kind of packer it is, and you don't have to use the unpacking function of procdump,which often not works due to the lack of scripts.The last thing we have to do is to change the entry point of the unpacker routine to the entry point we wrote down.
Lets start:
You need softice,procdump 1.4
Load your target into the symbol loader and softice will break at the beginning of the first unpacking routine:
You have to keep an eye on certain instructions,which indicate the end of the unpacker routine:
popad
jmp eax or to every other value hold in any of the registers
So trace further on,there is no need to trace into a call.Just use f10
And you will soon get to the following code snippet:
popad
popfd
mov ebx, *****
mov ***,******
jmp ebx
Trace until are at jmp ebx and you will see the "real" entry point in ebx.Infact, it isn't the entry point we want, it is just the entry point of the next unpacker routine.
therefore trace further on till you get to :
pop esi
pop edi
pop ebp
jmp eax
Well, in my case eax hold the value 00418000.IF you wonder, why i know,that we aren't allready in the unpacked main program,well,i dumped it every time i got to a jmp eax or ebx and ervery time i got only garbage when i dissasembled it in wdasm.But wait, the time will come...
Trace further on and you will see, that you are going trough the same codelines as you did before.When i reached:
pop esi
pop edi
pop ebp
jmp eax
eax hold the value 00417000.I thing, if i'm not mistaken, this rouitine only unpacks the sections.Trace further on and you will go through the same code once more,but eax will hold 00416000 (so it did in my case).
Now jump and you will find yourself in a different kind of code (suprise).But it doesn't matter,just trace on.... and you will jmp either to eax or to ebx (can't remember).Now eax or ebx will hold a different kind of value something like 00414319.I thought wow, i'm ready.I tried to jmp and i was very disappointed when i saw myself stepping trough the code,which i stepped trough a few times before.
Trace till you get to your jmp eax and eax will hold 00414000.Jump and what a suprise we are in the same code once more.You know,trace till you get to jmp eax and eax will hold 00413000.One more time,i promise you this will be the last time.Trace till you get to jmp eax and you will find eax holding 004011cb.It was a long way,baby, but this time all the unpackers have done their job,and the programm is unpacked into the memory.Why i know this?Well, i traced on and the code looked like the real code and,i was right after the second call, the program was executed.
What we have to do now, is to freeze the program,therefore because it must not execute any codeline anymore,wherelse the program ,which is now located in the memory will be overwritten ( i hope i'm right).
How to freeze the program?We put it into a loop,which will never end:
just do :
'a eip'
'jmp eip'
''
and press f5 or crtl-d.Now open procdump and you will see idcrkme60.exe in the task bar.Right click on it and select dump (full).You will prompt have to enter a new name for the dumped file.I chose unpacked.So,we know have dumped the unpacked program from the memory into a executeable file.But one more thing is missing:
You know, it still uses the entry point of the first packer routine.
If we don't change that to 004011cb,which is the real entry point (you rember),the program will crush.
So use the pe-editor of procdump,select your unpacked file and substitute the entry point 00019319 (= 00419319-00400000) with our entry point 000011CB(=004011CB-00400000).Okay try to run your file and you will be suprised that it works fine.
Now the protection scheme:
It isn't very difficult,therefore i don't explain it in detail.
Set a breakpoint on enablewindow and run the program.This function is used either to enable or disable a window ( the request button).You will break,press f11 till you are at the caller in the idcrkme60 file and scroll up a bit till you find a compare and afterwards a jnz jump.
Set a breakpoint there.And restart you program, and be shure that the enablewindow breakpoint is still active.Now you will break at the jnz jump.You will notice that it won't jump,therefore we have to change the z-flag. Do a 'r fl z' and you will see it will jump.Press f5 and you will see that the request button is activated.Press it and you will be kicked back to softice.Why? Due to enablewindow bp,which is called once more.Press f11 and scroll up a bit till you find a cond.jmp.Set a breakpiont there and restart your program.At the first cond. jmp change the flag,as i said and do that also when you break at the second cond.jmp.Now press f5 and we get a nice messagebox,telling us that we have cracked it.
That's all....
alpine
alpine@gmx.at
Thanks to the immortaldescendants and to Miz and Hobgoblin
