|
HiDownload_v1-17_loader_by_HanoiCracker/file_id.diz:
HiDownload 1.17 (2003-1-28)
-----------
What is HiDownload?
HiDownload is download manager, which helps you to download files from Internet.
HiDownload core feature is that it resumes broken downloads from where they lef
t off from HTTP, FTP and MMS servers. It saves your time, as you wouldn't ha
ve to download again what you already have on your hard-drive!
Also HiDownload split the files being downloaded in splits and download each spl
it simultaneously. That is from 3 to 5 times improvement!
HiDownload_v1-17_loader_by_HanoiCracker/Readme.txt:
Cracker: HanoiCracker@yahoo.com
URL:
Protection: Regcode/Time Limit
Program & Version HiDownload 1.17
Instructions:
Extract the loader.exe to the same directory as the HiDownload.ex
e.
Change the Start Menu shortcut to the new loader.exe instead of hidownload.
exe
Execute Loader.exe, enter any name,email and code to register.
This cracked is dedicated to my newly found babe: Minh Huyen
Thanks tKC, kROBAR and others for your excellent tutorials and tools which
make what I'm today
To the newbies: if you're interested in how I did this, please read the tuto
rial attached.
HiDownload_v1-17_loader_by_HanoiCracker/Tutorial.txt:
Hi
Welcome to my tutorial.
This has been my nth tutorial, but it maybe the first tutorial of mine that you&
#39;ve ever read. This is because I just write the tutorial for myself and seldo
m release them.
I've been cracking for 4 years and I don't consider myself newbies anymo
re:-). However, because I have no background in IT and my mother tongue is not E
nglish (you can tell from my nick that I'm Vietnamese which I'm proud of
), I would like to excuse my English and any inconvience or misunderstandin
g thereof.
In fact, you can't expect to see anything new in this tutorial. But if
you still interested in how to cracked a packed delphi with simple protection, p
lease read on.
Target: HiDownload 1.17
What it does: Another download program. (I downloaded and test tons of download
program but none support my Microsoft Proxy 2.0 with NTLM authenticatio
n:-(
Tools you need:
Dede by DaFixer
PE-Scan by snyper (or any other program to
DzaPatcher by DZA [TNT]
How to get these tools? Fire up Google and search, they're very readily avai
lable thanks to the great efforts of famous crackers.
1. Unpack the program with PE-Scan
Well, as I said earlier, the program is packed. How can I tell it? Because I sca
n it first with PE-Scan. Because when disassemble it with WinDasm (which I didn&
#39;t mention in the tools section because we won't use it) I saw no code at
all. Because I know that the program is coded in Delphi by using spy software a
nd look at the TButton, TText classes and when I disasemble it with Dede, i
t tells me the program is packed....
So use your favourite scan software and unpack software to unpack the program. I
use the PE-Scan by snyper. This is a very easy to use and versatile software. S
ave it as unpacked.exe
2. Disassemble the program with Dede.
Load the unpacked program in Dede. You'll easily notice the the name of the
nag form which tell us that this is an unregistered copy and ask us to enter the
name,email and code is TRegistrationWin and the Procedure which is called when
we click the Register Button is URegistrationWind.ButtRegClick.
3. Trace into ButtRegClick. You'll see the following after scroll it down a
bit
* Reference to: System.Proc_004050EC
|
00600E30 E8B742E0FF call 004
8;50EC
00600E35 8B45EC mov eax, [ebp-$14
]
00600E38 5A pop edx
* Reference to: UNetBeesPublic.Proc_0068B25C
|
00600E39 E81EA40800 call &#
48;068B25C <-- Reg code valid?
00600E3E 84C0 test al, al
00600E40 750F jnz 006
8;0E51 <-- Good guy
00600E42 8B45FC mov eax, [ebp-$04
]
* Reference to field TRegistrationWin.OFFS_0330
|
00600E45 C6803003000000
mov byte ptr [eax+$0330], $00
00600E4C E9CA010000 jm
p 0060101B <-- Bad guy
How did I notice these code? Because in the middle of the code, there are some c
all to write the User and Pass key to the registry. Before these code, there is
a jmp at 00600E4C to the end of the proc. It must be the Bad guy
jump.
4. From these code, we know that the call at 600E39 is to check the
entered reg
code. If the result is 1, it's valid and the reg info is saved into regi
stry,
otherwise, it does nothing. We assume that the program also use this function
when it starts to check whether or not the program is licensed. If we make the
function to always return 1, it's always registered.
5. So we trace into the call. At the end of the function we see
0068B39E 8A45FB mov al, byte ptr [ebp-$05]
0068B3A1 5F pop edi
0068B3A2 5E pop esi
0068B3A3 5B pop ebx
0068B3A4 8BE5 mov esp, ebp
0068B3A6 5D pop ebp
0068B3A7 C3 ret
6. So the return value is taken from [ebp-$05], we scoll it up a bit and we&
#39;ll
see:
* Reference to: System.Proc_00405170
|
0068B34E E81D9ED7FF call 004051
70 <-- some kind of check
0068B353 7506 jnz 0068B35B <-- B
ad guy
0068B355 C645FB01 mov byte ptr [ebp-$05]
, $01
0068B359 EB04 jmp 0068B35F
0068B35B C645FB00 mov byte ptr [ebp-$05]
, $00 <--- Hmm
0068B35F 33C0 xor eax, eax
So what do you think we need to do? Yeah, nop the jnz at 68B353 or change the
code at 68B35B to move byte ptr [ebp-$05],$01.
7. Run DZA Patcher
If we want to nop the jzn at 68B353
Enter 68B353 as virtual address, 75 as old value, 90 (=nop) as new value
68B354 06 90
Or if we want to change the move byte ptr[ebp-$05]
Enter 68B35E as virtual address, 00 as old value, 01 as new valu
e
Then you can make a loader, a patch depending on your choice.
It's mid night now. Got to sign off right now. Catch you later.
Have funs.
|
