chap6-1-61.htm.primary

加密与解密,软件加密保护技术与解决方案,看雪文档!

        R!SC 6/6/99 
  </table>
</div>
<div id="KB4Parent" class="parent"> <span class="p9"><a href="#" onClick="expandIt('KB4'); return false"> 
  4、习题四 答案</a></span></div>
<div id="KB4Child" class="child"> <span class="p9">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</span> 
  <table width="100%" align="center" cellspacing="0">
    <tr bgcolor="#EFEFEF"> 
      <td height="7" class="p9">How to crack R!SC's Play The Game CD-Check Crackme 
        by Killer_3K [DSi/Shock] <br>
        <br>
        Tools: Sice&amp;a mempatcher (i use R!SC's process patcher ;p) <br>
        <br>
        hey there, in this tut i'll teach u how to crack risc's PTG (play the 
        game) <br>
        CD-Check crackme. This Crackme is pretty nice, it detects sice (via int68), 
        <br>
        sorta hidden crc-check, packed, fake conditional jumps that leads to crash 
        <br>
        and more interesting stuff ;p <br>
        btw, don't bather unpacking it (it's packed w/ upx), as the readme says 
        that <br>
        ur not allowed to unpack in order to patch, it doesn't really matter anywayz, 
        <br>
        cause the way he fucked around w/ it about 96% of the code u'll get after 
        dasm <br>
        will be garbadge :P <br>
        <br>
        ok lets get started :) <br>
        fireup the crackme.. Doh, we get a msgbox saying "Kill Softice Mr. Cracker" 
        <br>
        ok lets get rid of it :) since the first time i got that crackme i didn't 
        <br>
        know how it detected it, so i'll tell u how i figured out how to kill 
        the sice <br>
        w/o knowing it uses int68 :) <br>
        <br>
        1) bpx on GetModuleHandleA and run the crackme, sice pops, but we see 
        Explorer <br>
        in the down-right corner, we don't want Explorer now do we :) Press F5 
        again <br>
        till u see 'Play the' in the down-left corner, ok, press F11 and start 
        tracing :) <br>
        u should see this: <br>
        <br>
        0177:00401143&nbsp; 68F0104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 004010F0 <br>
        0177:00401148&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; &nbsp; EAX <br>
        0177:00401149&nbsp; E818060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; KERNEL32!GetProcAddress <br>
        0177:0040114E&nbsp; A3B2204000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; [004020B2],EAX <br>
        0177:00401153&nbsp; 33C0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; &nbsp; EAX,EAX <br>
        0177:00401155&nbsp; 7533&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JNZ&nbsp; &nbsp; &nbsp; 0040118A <br>
        0177:00401157&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:00401159&nbsp; 68E7104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 004010E7 <br>
        0177:0040115E&nbsp; E80F060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; KERNEL32!GetModuleHandleA <br>
        0177:00401163&nbsp; 68FE104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 004010FE <br>
        0177:00401168&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; &nbsp; EAX <br>
        0177:00401169&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:0040116B&nbsp; E8F6050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; KERNEL32!GetProcAddress <br>
        0177:00401170&nbsp; A3B2204000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; [004020B2],EAX <br>
        <br>
        .. <br>
        ok, lets trace abit till we pass <br>
        <br>
        0177:00401168&nbsp; 50&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; PUSH&nbsp; &nbsp; &nbsp; EAX <br>
        0177:00401169&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:0040116B&nbsp; E8F6050000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; KERNEL32!GetProcAddress <br>
        0177:00401170&nbsp; A3B2204000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; [KERNEL32!AddAtomW],EAX <br>
        0177:00401175&nbsp; C70530204000433A2F00MOV&nbsp; &nbsp; &nbsp; DWORD 
        PTR [00402030],002F3A43 <br>
        <br>
        0177:0040117F&nbsp; 688A114000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 0040118A <br>
        0177:00401184&nbsp; FF2507214000&nbsp; &nbsp; &nbsp; &nbsp; JMP&nbsp; 
        &nbsp; &nbsp; [00402107] &lt;&lt;--- <br>
        <br>
        ok, lets trace and pass the jmp <br>
        u should now see this: <br>
        <br>
        0177:00401442&nbsp; 33D2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; XOR&nbsp; &nbsp; &nbsp; EDX,EDX <br>
        0177:00401444&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:00401446&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 00401449 <br>
        0177:00401448&nbsp; BD686C1440&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; EBP,40146C68 <br>
        . and some junk code after it <br>
        the jz is gonna jump, let it jump, or else the proggi will crash :] <br>
        <br>
        after the jz is taken, the code changed abit, and will change abit after 
        <br>
        couple of lines u trace.. u should now see this (maybe it will change 
        abit <br>
        during tracing :)): <br>
        <br>
        0177:00401449&nbsp; 686C144000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 0040146C &lt;-- will change to Add [edx], BH after we traced 
        it <br>
        0177:0040144E&nbsp; 3AC0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; AL,AL &lt;-- will change to INVALID after 
        we traced it <br>
        0177:00401450&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 00401453 <br>
        . <br>
        <br>
        ok this jz must be taken as well, or proggi will crash :) <br>
        after it comes an interesting piece of code (which change after u trace): 
        <br>
        <br>
        0177:00401453&nbsp; 64FF32&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        PUSH&nbsp; &nbsp; &nbsp; DWORD PTR FS:[EDX] <br>
        0177:00401456&nbsp; 8925A9204000&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; [004020A9],ESP <br>
        0177:0040145C&nbsp; 892DAD204000&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; [004020AD],EBP <br>
        0177:00401462&nbsp; 648922&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        MOV&nbsp; &nbsp; &nbsp; FS:[EDX],ESP <br>
        0177:00401465&nbsp; 3ADB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; BL,BL <br>
        0177:00401467&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 0040146A&nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; &nbsp; &nbsp; (JUMP ) <br>
        <br>
        hmm the jz wants to jump here too (i wonder why ;) (note the cmp bl,bl)) 
        <br>
        this time we don't have to make it jump, nop it or patch it to 7400 and 
        the anti-sice <br>
        is gone (btw u gotta patch it, as the crackme executes that piece of code 
        over and over..) <br>
        ok, ur prolly wondering why it doesn't detect sice now.. welp that jz 
        leads us to the <br>
        is_sice_there routine.. <br>
        lets take a look at that routine <br>
        after u'll take the jz u'll reach <br>
        0177:0040146A&nbsp; EB20&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JMP&nbsp; &nbsp; &nbsp; 0040148C <br>
        <br>
        which will lead us to a VERY interesting piece of code (will keep changing 
        during tracing): <br>
        <br>
        0177:0040148C&nbsp; 663BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        CMP&nbsp; &nbsp; &nbsp; SI,SI <br>
        0177:0040148F&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 00401492 (jump)&nbsp; &lt;&lt; <br>
        0177:00401492&nbsp; B443&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; MOV&nbsp; &nbsp; &nbsp; AH,43 ; move 0x43 to AH <br>
        0177:00401494&nbsp; CD68&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; INT&nbsp; &nbsp; &nbsp; 68 ; int68 (no shit ;)) <br>
        0177:00401496&nbsp; 5A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; POP&nbsp; &nbsp; &nbsp; EDX <br>
        0177:00401497&nbsp; 3BD2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; EDX,EDX <br>
        0177:00401499&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 0040149C&nbsp; (jump) &lt;&lt; <br>
        0177:0040149C&nbsp; 646789160000&nbsp; &nbsp; &nbsp; &nbsp; MOV&nbsp; 
        &nbsp; &nbsp; FS:[0000],EDX <br>
        0177:004014A2&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:004014A4&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 004014A7&nbsp; (jump) &lt;&lt; <br>
        0177:004014A7&nbsp; 5A&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; POP&nbsp; &nbsp; &nbsp; EDX <br>
        0177:004014A8&nbsp; 3BD2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; EDX,EDX <br>
        0177:004014AA&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 004014AD&nbsp; (jump) &lt;&lt; <br>
        0177:004014AD&nbsp; 663D86F3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        CMP&nbsp; &nbsp; &nbsp; AX,F386 !!! <br>
        0177:004014B1&nbsp; 58&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; POP&nbsp; &nbsp; &nbsp; EAX <br>
        0177:004014B2&nbsp; 7402&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 004014B6&nbsp; (jump) &lt;&lt;&lt; 
        <br>
        <br>
        <br>
        now, this is the anti-ice part :) u can nop ANY jz from 40148F until 4014B2, 
        and it will kill <br>
        the anti-ice, another way to kill it will be nopping the INT 68, anyway 
        will fit here :) <br>
        <br>
        if u'll keep tracing after 4014B2 w/o touching the jumps/int68 u'll reach 
        this piece of code: <br>
        <br>
        0177:004014B8&nbsp; 7401&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; JZ&nbsp; &nbsp; &nbsp; &nbsp; 004014BB&nbsp; (JUMP) <br>
        0177:004014B6&nbsp; 3BF6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; CMP&nbsp; &nbsp; &nbsp; ESI,ESI <br>
        0177:004014BB&nbsp; 68A5104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 004010A5 <br>
        0177:004014C0&nbsp; C3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; &nbsp; RET <br>
        which will lead u to: <br>
        0177:004014C1&nbsp; E85F020000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; 00401725 <br>
        0177:004010A5&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; &nbsp; 00 <br>
        0177:004010A7&nbsp; 6897104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 00401097 ; title (type d 401097 in sice and u'll see doh! 
        in widechar) <br>
        0177:004010AC&nbsp; 6863104000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; PUSH&nbsp; 
        &nbsp; &nbsp; 00401063 ; msg (type d 401063 in sice an u'll see Load anti-ice.. 
        in widechar) <br>
        0177:004010B1&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; &nbsp; 00 <br>
        0177:004010B3&nbsp; E8A8060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; USER32!MessageBoxW ; msgbox <br>
        0177:004010B8&nbsp; 6A00&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; 
        &nbsp; PUSH&nbsp; &nbsp; &nbsp; 00 <br>
        0177:004010BA&nbsp; E8B9060000&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; CALL&nbsp; 
        &nbsp; &nbsp; KERNEL32!ExitProcess ; exit proggi <br>
        <br>
        anywayz if u'll patch