1. Windows-
2. SoftICE/Win 2.oo
3.
3.1 Task Lock 3.00 -
3.2 Command Line 95 -
"-"
4.
Command Line 95
5. PUSH CALL
6. , Visual
Basic
==========
A. SoftICE
( etc)
B. GetWindowText,
GetDlgItemText GetDlgItemInt
C.
D.
1. WINDOWS-
======================================
Windows
,
Dos. Windows -
, ,
Windows.
( ) ,
-
SoftICE/Win 2.oo,
NuMega.
, ,
, ,
. =) A
,
.
URL ,
,
C.
- ED!SON,
edison@ccnux.utm.my
2. SOFTICE/WIN 2.OO
=========================
, SoftICE:
|--------------------|
| | 'R' -
|--------------------|
| | 'D' - , E' -
|--------------------|
| | 'U' - , 'A' -
|--------------------|
| |
|--------------------|
(
):
'H'/F1 -
F5/Ctrl+D - (
)
F8 -
F10 -
F11 - (
PUSH )
3.
==============================
,
- -
(shareware)
.
3.1 Task Lock 3.00 -
==============================================================
:
.
3.1.1
==============================
- 16
32 ?
?
- ,
?
,
.
....
....
?
... , ?...
OK, , 32-
,
Windows 95
,
"Register|Register...".
,
:
"" ( - site
license). ,
.
3.1.2
==========================
Windows Edit. ,
:
16- 32-
------ ------
GetWindowText GetWindowTextA, GetWindowTextW
GetDlgItemText GetDlgItemTextA, GetDlgItemTextW
32-
,
:
.
.
,
. "
GetWindowText..." -
!!!
, (
) SoftICE'.
, - .
A.
"" (
) SoftICE,
Ctrl-D BPX.
,
.
" " (Task Lock)
32- ,
GetWindowTextA. ,
.
SoftICE
:
:bpx getwindowtexta
(, "No LDT"),
,
. ,
Norton Commander
SoftICE.
:
:bl
-
:
00) BPX USER32!GetWindowTextA C=01
,
Ctrl-D ( F5) .
... ,
SoftICE
""
GetWindowTextA.
-
OK.
OK...
...
, .
,
GetWindowTextA... GetDlgItemTextA.
:
:bc 0
(0 -
)
:
:bpx getdlgitemtexta
, ...
3.1.3
=================
Wow! ! SoftICE,
GetDlgItemTextA.
,
, F11.
SGLSET.EXE. -
,
:
----------SGLSET!.text+1B0-w---------
:
:bd 0
, :
:be 0
:
CALL [USER32!GetDlgItemTextA]
,
Ctrl+Up (" ")
,
.
,
.
RET ;
PUSH EBP ;
MOV EBP, ESP ; ...
SUB ESP, 0000009C ; ...
PUSH ESI ; ...
> LEA EAX, [EBP-34] ; EAX = EBP-34
PUSH EDI ; ...
MOVE ESI, ECX ; ...
PUSH 32 ; .
> PUSH EAX ;
PUSH 000003F4 ;
PUSH DWORD PTR [ESI+1C] ;
CALL [USER32!GetDlgItemTextA] ;
PUSH
.
'>'. , ,
EAX EAX EBP-34h.
EBP-34h:
:d ebp-34
,
.
,
.
F10 ,
- EBP-34.
,
:
> LEA EAX, [EBP+FFFFFF64] ; EAX = EBP-9C
LEA ECX, [EBP-34] ; ECX = EBP-34
PUSH EAX ; EAX
PUSH ECX ; ECX
> CALL 00403DD0 ;
ADD ESP, 08 ;
TEST EAX, EAX ;
JNZ 00402BC0 ; , ""
,
.
: -
, - 0,
,
.
-
,
? ,
( ,
, )! -,
[EBP+FFFFFF64]? SoftICE
:
100000000 - FFFFFF64 = 9C
SoftICE:
:? 0-FFFFFF64
100000000 SoftICE,
0
.
,
EBP-9C...
:d ebp-9c
SoftICE
- !
,
? -
. ,
,
F10.
:
> LEA EAX, [EBP-68] ; EAX = EBP-68
LEA ECX, [EBP-34] ; ECX = EBP-34
PUSH EAX ; EAX
PUSH ECX ; ECX
> CALL 00403DD0 ;
ADD ESP, 08 ;
TEST EAX, EAX ;
JNZ 00402BFF ; ""
EBP-68?
!
:d ebp-68
... ,
? =)
3.2 Command Line 95 - "-",
======================================================================
- ,
.
3.1.1 ""
====================
,
32- ,
.
!
3.1.2
==========================
, Task Lock'
- .
:
GetWindowTextA GetDlgItemTextA. Ctrl-D,
:
:bpx getwindowtexta
:bpx getdlgitemtexta
,
- (
-
).
:
Name: ED!SON '96
Code: 12345
GetDlgItemTextA.
, Task
Lock', F11
.
Ctrl+Up.
:
MOV ESI, [ESP+0C]
PUSH 1E ;
PUSH 0040A680 ;
PUSH 000003ED ;
PUSH ESI ;
CALL [User32!GetDlgItemTextA]
40A680 ,
:
:d 40a680
,
, ? =)
:
PUSH 00 ; ( )
PUSH 00 ; ( )
PUSH 000003F6 ;
MOV EDI, 0040A680 ;
PUSH ESI ;
CALL [User32!GetDlgItemInt]
GetDlgItemInt GetDlgItemTextA,
,
.
EAX,
(F10) ,
...
:
EAX=00003039
3039?
:
:? 3039
:
00003039 0000012345 "09"
^ hex ^ dec ^ ascii
(, ,
) ,
. Ok, ?
:
MOV [0040A548], EAX ; .
MOV EDX, EAX ; EDX
3.1.3
=========================================
,
!
MOV ECX, FFFFFFFF ;
SUB EAX, EAX ;
REPNZ SCASB ; .
NOT ECX ; .
DEC ECX ; ECX
MOVSX EAX, BYTE PTR [0040A680] ;
. 40A680h
IMUL ECX, EAX ; ECX = ECX * EAX
SHL ECX, 0A ; 0Ah
ADD ECX, 0002F8CC ; 2F8CC
MOV [0040A664], ECX
...
CMP ECX, EDX ;
JZ 00402DA6 ; ,
,
,
:
:? ecx
:
000DC0CC 0000901324
, :
901324.
F5 Ctrl-D
,
(
). !
4.
COMMAND LINE 95
=================================================
.
,
:
code = ((uppercase_first_char * length_of_string) << 0x0A)
+ 0x2f8cc;
#1: ,
,
.
#2: "<< 0x0A"
" 2 10"
:
#include
#include
int main()
{
unsigned long code;
unsigned char buffer[0x1e];
printf("CommandLine95 Keymaker by ED!SON '96\n");
printf("Enter name: ");
gets(buffer);
strupr(buffer);
code = ( ((unsigned long)buffer[0] *
(unsigned long)strlen(buffer))
<< 0x0A) + 0x2f8cc;
printf("Your code is: %lu", code);
return 0;
}
!
4. PUSH CALL
============================================================
Task
Lock':
PUSH 32 ; .
PUSH EAX ;
PUSH 000003F4 ;
PUSH DWORD PTR [ESI+1C] ;
CALL [USER32!GetDlgItemTextA] ;
GetDlgItemTextA
C,
:
GetDlgItemTextA(hwndDlg, 0x3F4, buffer, 0x32);
^ [ESI+1C] ^ EAX
PUSH
, .
PUSH'
,
.
5. VISUAL BASIC
===============================
EXE , Visual Basic',
EXE.
VBRUNxxx.DLL,
EXE .
-EXE
,
Visual Basic' .
EXE
EXE ,
- DLL
.
,
"" DLL.
.
, Visual Basic'
2 3, -,
DoDi.
InterNet' (. C).
, Visual Basic'
4 (VB Windows 95),
,
, ,
. =)
( Bad_guy'): 5
Visual Basic ""
, .. SoftIce'.
:
Basic'. =)
====================================================================
====================================================================
A. SOFTICE
===========================================
, SoftICE
GetWindowText,
Ctrl-D
:
:exp getwindowtext
GetWindowText,
\SIW95\WINICE.DAT,
(';')
'exp=',
: "Examples of
export symbols that can be included for chicago"
.
'exp='
,
kernel32.dll,
user32.dll gdi32.dll,
.
.
B.
==============================
,
,
,
():
int GetWindowText(int windowhandle, char *buffer, int maxlen);
int GetDlgItemText(int dialoghandle, int controlid, char *buffer,
int maxlen);
int GetDlgItemInt(int dialoghandle, int controlid, int *flag, int
type);
,
Windows/Win32.
C.
======================
SoftICE/Win 2.oo:
http://www.geocities.com/SoHo/2680/cracking.html
VB:
ftp://ftp.sn.no/user/balchen/vb/decompiler/
,
TaskLock:
http://users.aol.com/Sajernigan/sgllck30.zip
CommandLine 95:
ftp://ftp.winsite.com/pub/pc/win95/miscutil/cline95.zip
D.
==========================
IRC (EFNet): #Ucf96, #Cracking
E-mail:
edison@ccnux.utm.my an461165@anon.penet.fi
WWW-:
http://www.geocities.com/SoHo/2680/cracking.html
