hex editor

EXESCOPE

Target: WinRAR v3.00

Author: hEYWIRE

About:

The purpose of this Tutorial is to offer help to anyone wishing to study the art of Reverse Code Engineering. Breaking protection systems in programs is an intellectual challenge, it should NOT be used to steal software. REMEMBER, I do my cracks/keygens as a hobby and challenge, so please, if you like the utility you crack and keep using it, support the author and pay for it! . Peace hEYWIRE

Program Info:

RAR is a powerful tool which allows you to manage and control archive files. The archive is usually a regular file, which name has a ".rar" suffix.
RAR features include:-
* Highly sophisticated, original compression algorithm
* Special compression algorithms optimized for text, audio, graphics data, 32 and 64-bit Intel executables
* Better compression than similar tools, using 'solid' archiving
* Authenticity verification (registered version only)
* Self-extracting archives and volumes (SFX)
* Ability to recover physically damaged archives
* Locking, password, file order list, file security & more ...

Registering :

Ok run the target program, Look around there is no where to register this program so it might be using the windows register/keyfile to look for a users registration details. Find out if the program is packed/Encrypted. We now know its written in Borland C++ and not packed/encrypted.

Load up W32DSM and dissemble the program. We also know it’s a 40-day trial so Forward you computers clock and re- run the program. We get a Dialog box reminding us to register etc… Look at the buttons on this dialog box:

Online registration

Price list

Sites list

Close

Help

Ok lets search in W32DSM for the text "Online registration" we find it here:

Name: REMINDER, # of Controls=007, Caption:"Please register", ClassName:""

001 - ControlID:0066, Control Class:"BUTTON" Control Text:"&Online registration"

002 - ControlID:0065, Control Class:"BUTTON" Control Text:"&Price list"

003 - ControlID:0067, Control Class:"BUTTON" Control Text:"&Sites list"

004 - ControlID:0001, Control Class:"BUTTON" Control Text:"Close"

005 - ControlID:0009, Control Class:"BUTTON" Control Text:"&Help"

006 - ControlID:FFFF, Control Class:"BUTTON" Control Text:""

007 - ControlID:FFFF, Control Class:"STATIC" Control Text:"Please note that"

Ok as we can see this dialog box is named "REMINDER" ok lets do a search for this the string "REMINDER". We find it here:

we could change JL at code location to 0043BB0E JG but looking at the above code we could change mov eax, dword ptr [004A877C] at code location 0043BB06 to move,eax,000. We do this because when we but our systems clock back we don’t want to see that REMINDER dialog. Run the program now. No Dialog box!

Ok so we have no REMINDER dialog box now, but we still have the string WinRAR-(evaluation copy) in the windows taskbar. In W32SDM do a search for the string "evaluation copy" we land here:

* Referenced by a (U)nconditional or (C)onditional Jump at Address:

|

* Possible Reference to String Resource ID=00873: "evaluation copy"

|

:0043F9B5 B869030000 mov eax, 00000369

:0043F9BA E8DDF1FCFF call 0040EB9C

:0043F9BF 50 push eax

:0043F9C0 8D942404020000 lea edx, dword ptr [esp+00000204]

:0043F9C7 52 push edx

:0043F9C8 E87B3C0300 call 00473648

:0043F9CD 83C408 add esp, 00000008

:0043F9D0 EB27 jmp 0043F9F9

From looking at the above peace of code we can see at code location 0043F9B0 the program is comparing EAX to 28h in DEC this 40. At code location 0043F9A4 there is a JNE, lets change these to a JMP.OK start the program and the string is gone. Great.

Note: EXESCOPY is a great program, which deserves your money if you continue to use it after the 2 weeks evaluation period. The author of this program is a really good programmer. But I can’t understand why he has such a bad serial/protection scheme. Its not as if he couldn’t write a better protection scheme.

Well thats the patching part of this program done. If you didnt notice you can register this program with a KeyFile. The program looks for a keyFile name rarkey.key.If you want to try your hand at cracking the program this way, the best thing to do is get the program to give you a messagebox saying thanks or what ever.Then you you can find the call/FLAG that decides if your registred or not. Some KeyFile proections are really tricky.You could also changed the registers. eg R EAX = EBX etc.. and reversed jumps with 'R FL Z' where needed to get your encrypted strings printed out to your bogus file.

Final Notes :

That’s it for this Tutorial, hope you learned something, if there is any spelling mistake or grammar errors then forgive me, IM only human. Just a short note, REMEMBER, I do my cracks/keygens as a hobby and challenge, so please, if you like the utility you crack and keep using it, support the author and pay for it! Peace hEYWIRE