888 ,e, e88'888 888,8, ,"Y88b e88'888 888 ee " 888 8e e88 888 d888 '8 888 " "8" 888 d888 '8 888 P 888 888 88b d888 888 Y888 , 888 ,ee 888 Y888 , 888 b 888 888 888 Y888 888 "88,e8' 888 "88 888 "88,e8' 888 8b 888 888 888 "88 888 , 88P "8",P" 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Programme : NetCost v2.0 Protection: Evaluation Period Ecrit par : LuCiFuGe RoFoCaLe [STYX] Type de Crack: Patch Date : 06/1998 Niveau: Debutant 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Introduction: 컴컴컴컴컴컴� De retour sur la scene, apres une periode passee dans la prorgrammation, je me suis attaque a ce soft, malheureusement le logiciel etant en francais , il a ete tres tres peu distribue. Donc j'ai decide de m'en servir comme support de cours ce qui facilitera la vie de nombreux debutant Pour ce faire vous aurrez besoin de: - W32Dasm v8.9 [Thx to Revolt] - le soft dispo sur http://netcost.home.ml.org Cette fois, nous allons supprimer la periode d'evaluation. Phase D'approche: 컴컴컴컴컴컴컴컴� Etudions le fonctionnement du soft: - Install NetCost - Lancer NetCost Manager, aller dans le panneau d'information. On obtient un truc du genre Ce logiciel est utilisable xx fois" - Lancer w32dasm et rechercher cette phrase on obtient: Adresse 48246C push 48260c 482471 mov eax,dword ptr[ebp-04] - En remontant un peu dans le programme , on s'appercoit que "times.cnt" est utilise. Regardons son contenu: [NOMBRE FOIS] Valeur=xxxx - Relancons le soft plusieurs fois, et a chaque fois la Valeur Change !! Donc on peut en conclure que Valeur est assimilable a un compteur. Phase Analyse: 컴컴컴컴컴컴컴 * Possible StringData Ref from Code Obj ->"times.cnt" | :004822BA BA48254800 mov edx, 00482548 :004822BF E8D417F8FF call 00403A98 :004822C4 8B4DF0 mov ecx, dword ptr [ebp-10] :004822C7 B201 mov dl, 01 :004822C9 A170254600 mov eax, dword ptr [00462570] :004822CE E8F902FEFF call 004625CC :004822D3 8BF0 mov esi, eax * Possible StringData Ref from Code Obj ->"066EC9" | :004822D5 685C254800 push 0048255C :004822DA 8D45FC lea eax, dword ptr [ebp-04] :004822DD 50 push eax * Possible StringData Ref from Code Obj ->"Valeur" | :004822DE B96C254800 mov ecx, 0048256C * Possible StringData Ref from Code Obj ->"NOMBRE FOIS" | :004822E3 BA7C254800 mov edx, 0048257C :004822E8 8BC6 mov eax, esi :004822EA E81103FEFF call 00462600 -> Lecture de la valeur :004822EF 8B55FC mov edx, dword ptr [ebp-04] :004822F2 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :004822F8 E8F772FFFF call 004795F4 :004822FD 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482303 C6403801 mov [eax+38], 01 * Possible StringData Ref from Code Obj ->"TWS Software" | :00482307 BA90254800 mov edx, 00482590 :0048230C E88772FFFF call 00479598 :00482311 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482317 E87C75FFFF call 00479898 :0048231C 8D45FC lea eax, dword ptr [ebp-04] :0048231F 8B93BC040000 mov edx, dword ptr [ebx+000004BC] :00482325 8B5228 mov edx, dword ptr [edx+28] :00482328 E87F15F8FF call 004038AC :0048232D 6A00 push 00000000 :0048232F 8D45F8 lea eax, dword ptr [ebp-08] :00482332 50 push eax * Possible StringData Ref from Code Obj ->"Nom_Utilisateur" | :00482333 B9A8254800 mov ecx, 004825A8 * Possible StringData Ref from Code Obj ->"LICENCE" | :00482338 BAC0254800 mov edx, 004825C0 :0048233D A1309A4800 mov eax, dword ptr [00489A30] :00482342 E8B902FEFF call 00462600 :00482347 6A00 push 00000000 :00482349 8D45F4 lea eax, dword ptr [ebp-0C] :0048234C 50 push eax * Possible StringData Ref from Code Obj ->"Num" | :0048234D B9D0254800 mov ecx, 004825D0 * Possible StringData Ref from Code Obj ->"LICENCE" | :00482352 BAC0254800 mov edx, 004825C0 :00482357 A1309A4800 mov eax, dword ptr [00489A30] :0048235C E89F02FEFF call 00462600 :00482361 8B55F4 mov edx, dword ptr [ebp-0C] :00482364 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :0048236A E88572FFFF call 004795F4 :0048236F 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482375 C6403801 mov [eax+38], 01 * Possible StringData Ref from Code Obj ->"TWS Software" | :00482379 BA90254800 mov edx, 00482590 :0048237E E81572FFFF call 00479598 :00482383 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482389 E80A75FFFF call 00479898 :0048238E 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482394 8B4028 mov eax, dword ptr [eax+28] :00482397 8B55F8 mov edx, dword ptr [ebp-08] :0048239A E80118F8FF call 00403BA0 :0048239F 752D jne 004823CE :004823A1 837DF400 cmp dword ptr [ebp-0C], 00000000 :004823A5 7427 je 004823CE :004823A7 8B55F8 mov edx, dword ptr [ebp-08] :004823AA 8B8394040000 mov eax, dword ptr [ebx+00000494] :004823B0 E853D0F9FF call 0041F408 :004823B5 8B55F4 mov edx, dword ptr [ebp-0C] :004823B8 8B8398040000 mov eax, dword ptr [ebx+00000498] :004823BE E845D0F9FF call 0041F408 :004823C3 8B838C040000 mov eax, dword ptr [ebx+0000048C] :004823C9 E87ED4F9FF call 0041F84C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:0048239F(C), :004823A5(C) | :004823CE 8D55EC lea edx, dword ptr [ebp-14] :004823D1 8B8394040000 mov eax, dword ptr [ebx+00000494] :004823D7 E8FCCFF9FF call 0041F3D8 :004823DC 8B45EC mov eax, dword ptr [ebp-14] * Possible StringData Ref from Code Obj ->"Utilisateur non enregistr" | :004823DF BAE8254800 mov edx, 004825E8 :004823E4 E8B717F8FF call 00403BA0 :004823E9 0F8518010000 jne 00482507 :004823EF 8B45FC mov eax, dword ptr [ebp-04] :004823F2 E83D4AF8FF call 00406E34 :004823F7 85C0 test eax, eax :004823F9 0F8EB8000000 jle 004824B7 :004823FF 8B45FC mov eax, dword ptr [ebp-04] :00482402 E82D4AF8FF call 00406E34 :00482407 48 dec eax :00482408 8D55F0 lea edx, dword ptr [ebp-10] :0048240B E8F449F8FF call 00406E04 :00482410 8B55F0 mov edx, dword ptr [ebp-10] :00482413 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482419 E8D671FFFF call 004795F4 :0048241E 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482424 C6403800 mov [eax+38], 00 * Possible StringData Ref from Code Obj ->"TWS Software" | :00482428 BA90254800 mov edx, 00482590 :0048242D E86671FFFF call 00479598 :00482432 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482438 E85B74FFFF call 00479898 :0048243D 8B83BC040000 mov eax, dword ptr [ebx+000004BC] :00482443 8B4028 mov eax, dword ptr [eax+28] :00482446 50 push eax * Possible StringData Ref from Code Obj ->"Valeur" | :00482447 B96C254800 mov ecx, 0048256C * Possible StringData Ref from Code Obj ->"NOMBRE FOIS" | :0048244C BA7C254800 mov edx, 0048257C :00482451 8BC6 mov eax, esi :00482453 E80802FEFF call 00462660 -> Ecriture de la Valeur !!!! :00482458 8BC6 mov eax, esi :0048245A E8E108F8FF call 00402D40 :0048245F 8B45FC mov eax, dword ptr [ebp-04] :00482462 E8CD49F8FF call 00406E34 :00482467 48 dec eax :00482468 85C0 test eax, eax :0048246A 7E3B jle 004824A7 * Possible StringData Ref from Code Obj ->"Ce logiciel est encore utilisable " | :0048246C 680C264800 push 0048260C :00482471 8B45FC mov eax, dword ptr [ebp-04] :00482474 E8BB49F8FF call 00406E34 :00482479 48 dec eax :0048247A 8D55E8 lea edx, dword ptr [ebp-18] :0048247D E88249F8FF call 00406E04 :00482482 FF75E8 push [ebp-18] * Possible StringData Ref from Code Obj ->" fois" | :00482485 6838264800 push 00482638 :0048248A 8D45F0 lea eax, dword ptr [ebp-10] :0048248D BA03000000 mov edx, 00000003 :00482492 E8B916F8FF call 00403B50 :00482497 8B55F0 mov edx, dword ptr [ebp-10] :0048249A 8B8398040000 mov eax, dword ptr [ebx+00000498] :004824A0 E863CFF9FF call 0041F408 :004824A5 EB10 jmp 004824B7 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0048246A(C) | * Possible StringData Ref from Code Obj ->"C'est la derni" | :004824A7 BA48264800 mov edx, 00482648 :004824AC 8B8398040000 mov eax, dword ptr [ebx+00000498] :004824B2 E851CFF9FF call 0041F408 * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:004823F9(C), :004824A5(U) | :004824B7 8B45FC mov eax, dword ptr [ebp-04] :004824BA E87549F8FF call 00406E34 :004824BF 85C0 test eax, eax :004824C1 7544 jne 00482507 -> Lance le soft :) :004824C3 8BC6 mov eax, esi -> ne Lance pas le soft :( :004824C5 E87608F8FF call 00402D40 :004824CA 6A00 push 00000000 :004824CC 668B0D84264800 mov cx, word ptr [00482684] :004824D3 B202 mov dl, 02 * Possible StringData Ref from Code Obj ->"Pour continuer " | :004824D5 B890264800 mov eax, 00482690 :004824DA E8FDA5FBFF call 0043CADC :004824DF 3C02 cmp al, 02 :004824E1 750C jne 004824EF :004824E3 B801000000 mov eax, 00000001 :004824E8 E80F13F8FF call 004037FC :004824ED EB18 jmp 00482507 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:004824E1(C) | :004824EF 8B0D7C7E4800 mov ecx, dword ptr [00487E7C] :004824F5 A1C87F4800 mov eax, dword ptr [00487FC8] :004824FA 8B00 mov eax, dword ptr [eax] :004824FC 8B15A0054800 mov edx, dword ptr [004805A0] :00482502 E895CBFAFF call 0042F09C * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:004823E9(C), :004824C1(C), :004824ED(U) | :00482507 33C0 xor eax, eax :00482509 5A pop edx :0048250A 59 pop ecx :0048250B 59 pop ecx :0048250C 648910 mov dword ptr fs:[eax], edx :0048250F 6839254800 push 00482539 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00482537(U) | :00482514 8D45E8 lea eax, dword ptr [ebp-18] :00482517 E8F812F8FF call 00403814 :0048251C 8D45EC lea eax, dword ptr [ebp-14] :0048251F E8F012F8FF call 00403814 :00482524 8D45F0 lea eax, dword ptr [ebp-10] :00482527 BA04000000 mov edx, 00000004 :0048252C E80713F8FF call 00403838 :00482531 C3 ret Phase d'attaque: 컴컴컴컴컴컴컴컴 deux solutions , on peut soit essayer d'empecher le soft de modifier le fichier "times.cnt" soit lui dire que quelque soit la valeur c'est tjrs bon . On fera dans ce cours cette derniere , l'autre etant carrement evidente. - Que ce passe t'il ? lorsque on lance le soft, on passe par toutes les etapes a) Soft Registre b) Non Enregistre donc x fois d'utilisation c) Idem mais derniere utilisation d) Evaluation depassee donc si le soft est "perime", on arrive sur: :004824BA E87549F8FF call 00406E34 :004824BF 85C0 test eax, eax :004824C1 7544 jne 00482507 -> Lance le soft :) :004824C3 8BC6 mov eax, esi -> ne Lance pas le soft :( :004824C5 E87608F8FF call 00402D40 il suffit donc de faire un jmp 00482507 a l'adresse 4824C1. soit le patch suivant: offset 818C1h EB44 C'est encore la demonstration d'une protec a deux balles ;) vous pouvez biensur patcher le soft pour qu'il soit enregistre, mais cela vous fera changer plus d'un octect pour obtenir un resultat similaire... Ne pas oublier qu'un bon cracker est un cracker faineant ;o) 컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴컴� Voila c'est enfin fini .. enfin presque car il vous reste a supprimer la meme chose sur netcost counter !!! bonne chance :) offset 44DFEh EB26 LuCiFuGe RoFoCaLe [STYX/WARP] 1998