You are here: start / cracks

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revisionBoth sides next revision
cracks [2015/11/26 20:45] – [Applying Binary Patches] officecracks [2017/02/22 18:30] – external edit 127.0.0.1
Line 1: Line 1:
 +====== Disclaimer and Purpose of the Documents ======
  
 +<WRAP important>
 +The content on the following pages describes how various software protections can be defeated by using very simple techniques - we try to the stick to the simplest ones. In no way should you use these cracks for any illegal purposes and we definitely do not support or condone any illicit behaviour from our readers. All the cracking procedures describe a way of attacking various software packages and we encourage the creators to improve the quality of their software by eliminating the flaws that we point out in the pages that follow from this name-space. Similarly, we would also like to point out to the public how the software is protected, as a risk management, in many cases where the software being attacked is able to transmit or hide data from the intended audience with or without their consent.
 +</WRAP>
 +
 +====== About ======
 +
 +The following programs have been reverse-engineered using:
 +
 +  * [[http://www.charlessoft.com/|NibUnlocker]] - for removing menu items and reverse-engineering interface elements.
 +  * [[http://www.suavetech.com/0xed/0xed.html|0xED]] - a good and free OSX hex editor.
 +  * [[http://hopperapp.com/|Hopper Disassembler]] - an amazing and cheap disassembler compared to the moguls such as ''IDA''.
 +
 +Wizardry and Steamworks does not distribute any pirated software. We are not a warez site. By following the instructions you will be able to break this software yourself and gain your own experience in the process.
 +
 +For exercise' sake, the software in this section was cracked without using a debugger (except in one or two cases, using ''gdb'', after the crack, for clarifications) and the operations have been restricted to flow-control manipulation and code-elimination - our signature move. :-)
 +
 +====== Theory ======
 +
 +We use a brute-approach to cracking programs, based on intuition and manipulation of flow control. Disassembling any piece of software yields a series of data movements between memory addresses, calls to functions that do more of that and a bunch of jumps (or ''goto''s) between them.
 +
 +Every program consists of a series of a top-down flow of sequentially executed commands. If the program is event-driven, or threaded, if we were to coalesce all the threads into one single top-down flow, every command will be executed one after the other with a difficult, yet consistent trend of being sequential. The difficulty is that we may not be able to determine at what point a command will be executed but we will be able to observe the flow of execution. That is, unless all operations are atomic, we know the flow and can observe the decisions but we cannot tell when they will be executed. 
 +
 +===== if =====
 +
 +On a high-level, ''if''-branches can be observed as a disposition of ''read'', ''compare'' and ''jump'' commands. The flowchart illustrates the typical pattern of decision making in the cracks bellow and the ''C'' and ''ASM'' counterparts illustrate the typical case in programming.
 +
 +<WRAP centeralign>
 +<WRAP column 40% round box>
 +===== Flow =====
 +<latex>
 +\begin{tikzpicture}[scale=2, node distance = 2cm, auto]
 +    % Place nodes
 +    \node [block] (read) {\texttt{read}};
 +    \node [decision, below of=read] (compare) {\texttt{compare}};
 +    \node [block, right of=compare, node distance=2.5cm] (jump) {\texttt{jump}};
 +    \node [block, below of=compare, node distance=2.5cm] (continue) {\texttt{continue}};
 +    % Draw edges
 +    \path [line] (read) -- (compare);
 +    \path [line] (compare) -- (jump);
 +    \path [line] (compare) -- (continue);
 +\end{tikzpicture}
 +</latex>
 +</WRAP>
 +<WRAP column 40% leftalign>
 +===== C =====
 +<code c>
 +int reg = isRegistered(); // read
 +if(reg != 1) { // compare
 +  return; // jump
 +}
 +start(); // continue
 +...
 +</code>
 +</WRAP>
 +<WRAP column 40% leftalign>
 +===== ASM =====
 +<code asm>
 +xor        cl, cl ; read (exchange)
 +cmp        rax, rbx ; compare
 +jle        0x10001FF07 ; jump
 +mov        cl, 0x1 ; continue
 +...
 +</code>
 +</WRAP>
 +<WRAP clear>
 +</WRAP>
 +</WRAP>
 +
 +Manipulating ''if''-branches consists in negating either of the branches in order to favour in outcome. Better illustrated, let's take the code from the flow-chart above:
 +
 +<code c>
 +int reg = isRegistered(); // read
 +if(reg != 1) { // compare
 +  return; // jump
 +}
 +start(); // continue
 +...
 +</code>
 +
 +If ''reg'' after the call to ''isRegistered()'' (//read//) does not hold the value ''1'' (//compare//) then the function that the program is in returns (//jump//) and the outcome is that the program will not reach ''start()'' (//continue//) - and we definitely do want to get the program to start.
 +
 +In order to do that, we manipulate the outcome of the ''if'' clause, barbarically, by just getting rid of jump:
 +
 +<code c>
 +int reg = isRegistered(); // read
 +if(reg != 1) { // compare
 +
 +}
 +start(); // continue
 +...
 +</code>
 +
 +Now the ''if''-clause becomes superfluous. It does not matter whether ''reg'' holds the value ''1'' or not because the program will never return:
 +
 +<code c>
 +if(reg != 1) { // compare
 +
 +}
 +</code>
 +
 +There are many ways to eliminate the jump in assembler. The most obvious, given the top-down flow of execution, is to get rid of the jump (''jle''):
 +
 +<code asm>
 +xor        cl, cl ; read (exchange)
 +cmp        rax, rbx ; compare
 +jle        0x10001FF07 ; jump
 +mov        cl, 0x1 ; continue
 +...
 +</code>
 +
 +by substituting the jump using some ''NOP''s (no operation):
 +
 +<code asm>
 +xor        cl, cl ; read (exchange)
 +cmp        rax, rbx ; compare
 +nop        ; no more jumping
 +nop        ; 
 +mov        cl, 0x1 ; continue
 +...
 +</code>
 +
 +Thus the comparison:
 +<code asm>
 +cmp        rax, rbx ; compare
 +</code>
 +is not even checked. We can ''NOP'' the ''CMP'' as well, if we want to be tidy, but it is not needed.
 +
 +===== () =====
 +
 +Very often we want to short-circuit functions, namely functions that are labeled ''needsRegistration'', ''hasToBeNaggedAboutIt'', and as in [[cracks:jitouch:v2.x|Jitouch v2]], functions named ''popTheJollyRoger'' (it turned out to be a red herring). Functions can also be easily be short-circuited by understanding the basic flow. Code is organised in blocks that are called in succession and after they have executed, they return. From the call-stack point of view, this is rather dumb operation: pop the frame, execute the code and return to the callsite.
 +
 +<WRAP centeralign>
 +<WRAP column 40% round box>
 +===== Flow =====
 +<latex>
 +\begin{tikzpicture}[scale=2, node distance = 2cm, auto]
 +    % Place nodes
 +    \node [block] (enter) {\texttt{enter}};
 +    \node [block, below of=enter, node distance=2.5cm] (execute) {\texttt{execute}};
 +    \node [block, below of=execute, node distance=2.5cm] (return) {\texttt{return}};
 +    % Draw edges
 +    \path [line] (enter) -- (execute);
 +    \path [line] (execute) -- (return);
 +\end{tikzpicture}
 +</latex>
 +</WRAP>
 +<WRAP column 40% leftalign>
 +===== C =====
 +<code c>
 +needsLicenseReminder() { // enter
 +  ... // execute
 +  return; // return
 +}
 +</code>
 +</WRAP>
 +<WRAP column 40% leftalign>
 +===== ASM =====
 +<code asm>
 +_needsLicenseReminder: ; enter
 +push       rbp
 +rbp, rsp
 +r15
 +r14
 +rbx
 +...                    ; execute
 +pop        rbx
 +pop        r14
 +pop        r15
 +pop        rbp
 +ret                    ; return
 +</code>
 +</WRAP>
 +<WRAP clear>
 +</WRAP>
 +</WRAP>
 +
 +Since we are very important people and do not need a license, we can short-circuit this function such that it does not do anything. We could even ''NOP'' out the call to it, but let us be tidy and have an overview of what we are doing:
 +
 +<code asm>
 +_needsLicenseReminder: ; enter
 +       push       rbp
 +       mov        rbp, rsp
 +       push       r15
 +       push       r14
 +       push       rbx
 +       jmp        0x2129      ; jump
 +...                    
 +0x2129 pop        rbx
 +       pop        r14
 +       pop        r15
 +       pop        rbp
 +       ret                    ; return
 +</code>
 +
 +The result of adding a ''jmp'' to ''0x2129'' is that the function ''_needsLicenseReminder'' will be called and then it will return thereby doing absolutely nothing.
 +
 +===== Stuff You Will Need To Know =====
 +
 +The number of operations and rules you will need to learn is very small, in fact, there are only ''4'' things you need to know. Most of the time you can guess what the program does by looking at ''XREF''s.
 +
 +  * Jumps are prefixed by ''j''. That is the case of ''jmp'', ''jnle'', ''jle'', etc... ''jmp'' being the main player which is an unconditional jump. ''jnle'', ''jle'' and the rest of the family are translated to "jump to address if not less equal", "jump if less equal" and so on... However, the technique described here does not require you to frown very hard trying to remember what ''je'' meant. It is ridiculously translated to: "if some crap happens, then jump somewhere".
 +
 +  * Return from functions as you enter them, symmetrically. This is due to the way that functions are called and how they return (stack based). We can make a simple rule out of this: "what function pushes on entry, that it shall pop on return".
 +
 +  * The opcode for return is ''ret''. Very boilerplate. Some functions implement a stack guard, that sort of slings out of the function, then returns back, performing checksums and whatever other rubbish. You can generally ignore this, mind the previous rule, and jump to the ''ret'' instead of the garbage checks.
 +
 +  * ''NOP'' means no-operation. Remember that programs execute commands sequentially and that a series of ''nop''s one after the other means perpetually doing nothing, up to the first operation that is not a ''nop''.
 +
 +===== Flow Equivalence =====
 +
 +As you may have noticed, ''NOP'' can in fact be emulated by a jump forward by one operation. That is, both the left-side and the right-side of the following boxes are equivalent:
 +
 +<WRAP centeralign>
 +<WRAP column 45% leftalign>
 +<code asm>
 +0x0001 nop               ; do nothing
 +0x0002 mov    rdi, r14   ; move
 +</code>
 +</WRAP>
 +<WRAP column 45% leftalign>
 +<code asm>
 +0x0001 jmp    0x0002     ; jump forward
 +0x0002 mov    rdi, r14   ; move
 +</code>
 +</WRAP>
 +<WRAP clear>
 +</WRAP>
 +</WRAP>
 +
 +More precisely, we can say that a ''NOP'' is semantically equivalent to a ''JMP'' by one operation forward. This is needed, in cases where, say, you are too lazy to write a ''NOP'' and need to use a ''JMP''. The converse is also true.
 +
 +===== NOP Sledges =====
 +
 +The illustriously wise frequently take some post-condition and slide it via ''NOP''s to some check. Something along these lines:
 +
 +<WRAP centeralign>
 +<WRAP column 45% leftalign>
 +<code c>
 +int reg = getRegistered();
 +if(reg == 1) {
 +  reg = 1; // very clever!
 +  printf("You are now registered!");
 +  return;
 +}
 +
 +printf("Demo will expire in 7 days!");
 +setTimer();
 +
 +return;
 +</code>
 +</WRAP>
 +<WRAP column 45% leftalign>
 +<code asm>
 +mov rbx, 0x1 ; reg = 1
 +nop          ; fuuuuuuuuuu..
 +nop          ; ...uuuuuuuuuuu...
 +nop          ; ...uuuuuuuuuuu...
 +...
 +...
 +...
 +...
 +...
 +nop          ; uuuuuuuuuuuuuuuu!
 +ret
 +</code>
 +</WRAP>
 +<WRAP clear>
 +</WRAP>
 +</WRAP>
 +
 +which essentially moves the assignment, by setting ''reg'' to ''1'' out of the way of any other checks. It does that by sliding on the ''nop'' sledge, ignoring every operation till the function returns. We could have found a better example and you can also tell that the bunch of ''NOP''s could be replaced by a single ''JMP''. However, there are cases, where you would want to slide ''reg = 1'' to some ''if''-clause that tests whether ''reg'' is equal to ''1'' later on, in the function. In illustrious wise terms, this is called sliding a post-condition to a check such that the post-condition will not be invalidated during the slide (by the other crap in-between, yo!).
 +
 +
 +====== Applying Binary Patches ======
 +
 +''bsdiff'' can be used to create and apply binary patches. Most of the cracks presented here are for OSX and you will need either [[http://www.macports.org/|MacPorts]] or [[http://brew.sh/|Homebrew]] to apply the patches. In case you have access and assuming you have Homebrew install, issue in a terminal:
 +<code bash>
 +brew install bsdiff
 +</code>
 +in case you have MacPorts, issue:
 +<code bash>
 +port install bsdiff
 +</code>
 +
 +in order to install ''bsdiff''.
 +
 +Patches are named in this namespace conventionally and you will need to copy & paste the gibberish text in files before applying them. For example, the patch for ''filename'' would be pasted in a file called:
 +<code>
 +filename.bsdiff.uue
 +</code>
 +the ''uue'' extension indicating an universal encoded file (using ''uuencode''), and:
 +<code>
 +filename.bsdiff
 +</code>
 +to indicate a patch file.
 +
 +In order to patch ''filename'', you will first have to decode ''filename.bsdiff.uue'' in order to obtain the ''filename.bsdiff''. This can be performed in a terminal by issuing:
 +<code bash>
 +uudecode -o filename.bsdiff < filename.bsdiff.uue
 +</code>
 +at which point you will have obtained the ''filename.bsdiff'' file.
 +
 +The next step is to apply the patch. This can be done by moving ''filename.bsdiff'' to where ''filename'' is to be found (usually indicated in the patches section of every crack) and then issuing:
 +<code bash>
 +bspatch filename filename filename.bsdiff
 +</code>
 +which will apply the patch ''filename.bsdiff'' to ''filename''.
 +
 +Remember that if you patched a binary with ''bsdiff'', the binary may not be executable after the patch. So you need to set the executable bit on the file by running:
 +<code bash>
 +chmod +x filename
 +</code>
 +in case the executable will not load.
 +====== Two Types of People: Some Have Seen Assembler, Some Did Not ======
 +
 +{{ cracks_orly.png }}
 +====== Index ======
 +
 +{{indexmenu>cracks}}
cracks.txt · Last modified: 2023/10/15 14:13 by office
You are here: start / cracks

Access website using Tor Access website using i2p Wizardry and Steamworks PGP Key


For the contact, copyright, license, warranty and privacy terms for the usage of this website please see the contact, license, privacy, copyright.