continuing drlan's work
Not Assigned
by Fravia+
980715
bb
0100
NA
PC
|
continuing drlan's work |
Not Assigned | |
|
by Fravia+ |
|
| fra_00xx 980715 bb 0100 NA PC | ||
Well, not quite. We also need to fool the caller a bit. Let's take a look at that EnumWindows call that Drlan mentions. For our purposes, it's important. (I'm using the VIW.EXE as our little test proggie.)
Inside the callback function of the EnumWindows, we have:
00017747: 8B7508 mov esi,[ebp][00008] 0001774A: 6AEB push 0EB 0001774C: 56 push esi 0001774D: FF15F8B64300 call GetWindowLongA ;USER32.dll 00017753: 3DEBED0900 cmp eax,00009EDEB 00017758: 7533 jne .00001778D ---------- (1) 0001775A: 8D459C lea eax,[ebp][-0064] 0001775D: 6A64 push 064 0001775F: 50 push eax 00017760: 56 push esi 00017761: FF1538B84300 call GetWindowTextA ;USER32.dll 00017767: 8D4D9C lea ecx,[ebp][-0064] 0001776A: 68BCEB4200 push 00042EBBC ; "MKS Toolkit Demo" 0001776F: 51 push ecx 00017770: E8BB540000 call .00001CC30 ---------- (2) 00017775: 83C408 add esp,008 00017778: 85C0 test eax,eax 0001777A: 7511 jne .00001778D ---------- (3)
Ok, we start with a GetWindowLong(arg_8, 0xeb). The 0eb is most probably for the USERDATA. (check your header files if you're unsure..) That would mean the CMP right before jmp#1 is a magic number that our window needs to have in it's userdata. Once it passes that, we have a GetWindowText, which will pull our the window title into the buffer at ebp-64. That buffer, along with an argument @ 42eBBc which just so happens to be the text "MKS Toolkit Demo", gets passed to call#2, so we can guess that's the strcmp.
So we've got to fool this guy with two things: our userdata section has to have the magic number 0x09edeb in it, and our window needs to be called "MKS Toolkit Demo". Right on, let's write some code.
I'm using LCC, so some particulars apply differently to the compiler that you may choose. I've got code that looks like:
#include <win.h>
main()
{
HWND hwnd;
hwnd=CreateWindow(
"STATIC" /* lpClassName */,
"MKS Toolkit Demo" /* lpWindowName */,
WS_DISABLED|WS_POPUP /* dwStyle */,
0 /* x */,
0 /* y */,
0 /* nWidth */,
0 /* nHeight */,
NULL /* hWndParent */,
NULL /* hMenu */,
NULL /* hInstance */,
0 /* lParam */ );
if (hwnd==NULL) {
printf("no hwnd\n");
exit(-1);
}
SetWindowLong(hwnd,GWL_USERDATA,0x0009edeb);
SetWindowText(hwnd,"MKS Toolkit Demo");
Sleep(1000);
exit(0);
}
We create a window of no size, set the appropriate magic number and window
text, then sleep for a short time, allowing our MKS executable to find us and
bypass the evil message about being unable to start MKSDEMO.EXE... Compile
this and link it with "-subsystem windows", replace the old MKSDEMO.EXE, and
you've got no more nag. Now let's move on to the time limit.
What do we have here? Well, we've got a registry value in HKEY_LOCAL_MACHINE called SOFTWARE\Mortice Kern Systems\Toolkit\DemoVersion\DemoNumber which contains some number that represents the software install date, and then we've got another routine that comes along with a GetSystemTime and produces a similar number. A comparison between these two numbers is done, and if it just so happens to differ beyond 0x278d00, or thirty days, the executable refuses to work.
My first thought was to hook the RegQueryValueEx API function to check if we're looking for that registry key, and if we are, do a GetSystemTime and return the appropriate juju. That would probably work, though it would mean we'd need some sort of setup program for MKS to initialize the hook, and that just seems sloppy.
But then it occurred to me, since every executable is calling MKSDEMO, why can't we just have MKSDEMO update the key to the current time everytime a MKS tool is run? After I stopped giggling (for some reason, I found this intensely funny), I realized that this was justice preserved. MKS went through all this trouble to make it hard on us, and here we are using the mechanism of their own obstructionist tactics against them.
So our object now is to figure out how the number in the registry key is developed from GetSystemTime, and then to put that code into our own MKSDEMO.C. Our install time in DemoNumber will get updated to the current time and our 30-day trial will consistently renew itself whenever we run an MKS tool.
At 4175e0 we have our call to RegQueryValueEx, and there's a call to 423420 shortly thereafter, which has our GetSystemTime in it. The function at 423420 returns the number we want in eax, so we've got to reverse this routine. We need to remember the SYSTEMTIME structure, so follow along. (In this code, the WORDs of the structure get shoved into the DWORDs of the registers. Many times the WORD in the high part of the DWORD gets masked out, sometimes it doesn't; the high WORD never matters, though, so I'm ignoring it in the comments.)
typedef struct _SYSTEMTIME {
WORD wYear; // 0x10
WORD wMonth; // 0x0e
WORD wDayOfWeek; // 0x0c
WORD wDay; // 0x0a
WORD wHour; // 0x08
WORD wMinute; // 0x06
WORD wSecond; // 0x04
WORD wMilliseconds; // 0x02
} SYSTEMTIME;
The fairly long code snippet looks like:
00023420: 55 push ebp
00023421: 8BEC mov ebp,esp
00023423: 83EC10 sub esp,010
00023426: 53 push ebx
00023427: 56 push esi ; save regs
00023428: 8D45F0 lea eax,[ebp][-0010]
0002342B: 57 push edi ; save edi
0002342C: 50 push eax
0002342D: FF1590B64300 call GetSystemTime ; ebp-10=Systemtime
00023433: 8B5DF2 mov ebx,[ebp][-000E] ; ebx=wMonth
00023436: 8B45F0 mov eax,[ebp][-0010] ; eax=wYear
00023439: 8BCB mov ecx,ebx
0002343B: 8B55F6 mov edx,[ebp][-000A] ; edx=wDay
0002343E: 81E1FFFF0000 and ecx,00000FFFF
00023444: 4A dec edx ; wDay--
; the table in 42f73e is
; int mon2day[14]={ 0x0, 0x0, 0x1f, 0x3b, 0x5a, 0x78, 0x97, 0xb5,
; 0xd4, 0xf3, 0x111, 0x130, 0x14e, 0x16d };
; which, given a month, gives us the number of days for each month since Jan 01
00023445: 668B344D3EF74200 mov si,[00042F73E][ecx]*2 ; si=mon2day[ecx]
0002344D: 8D8844F8FFFF lea ecx,[eax][0FFFFF844] ;ecx=edi-1980
00023453: 8BF9 mov edi,ecx ; edi=wYear-1980
00023455: 6603F2 add si,dx ; si += wDay
; si now = the number of days into the year from Jan 01, discounting the leap year
; so we should expect a leap calculation now
00023458: 81E7FFFF0000 and edi,00000FFFF
0002345E: 8BC7 mov eax,edi ; eax=wYear-1980
00023460: 99 cdq ; edx=0, (usually a precursor to a modulo?)
00023461: 33C2 xor eax,edx
00023463: 2BC2 sub eax,edx
00023465: 83E003 and eax,003 ; eax = wYear % 3
00023468: 33C2 xor eax,edx
0002346A: 2BC2 sub eax,edx
0002346C: 7507 jne .000023475 ; if we're not in a leap year, jump
0002346E: 6683FB02 cmp bx,002 ; if we're not past February yet,
00023472: 7601 jbe .000023475 ; jump
00023474: 46 inc esi ; add a day
; our leap year calculation is done
00023475: 8D14C9 lea edx,[ecx][ecx]*8 ; edx=9*(wYear-1980)
00023478: 8D4703 lea eax,[edi][00003] ; eax=(wYear-1980)+3 (+3?)
0002347B: 8D0CD1 lea ecx,[ecx][edx]*8 ; ecx=73*(wYear-1980)
; 73 is an important number, 73 * 5 = 365, we should see that nearby
0002347E: 99 cdq ; edx =0
0002347F: 8BD9 mov ebx,ecx
00023481: 83E203 and edx,003
00023484: 03DE add ebx,esi ; ebx=(73(wYear-1980)+#days)
00023486: 03C2 add eax,edx
00023488: C1F802 sar eax,002 ; eax=(wYear+3)/4
; this eax will be used to calculate how many leap days have past
0002348B: 8D0C8B lea ecx,[ebx][ecx]*4 ; ecx=73*5*wYear+si=365wYear+si
; Here's our 365 days a year we're calculating since 1980
0002348E: 8D8408440E0000 lea eax,[eax][ecx][000000E44]
; and here we have an adjustment for 3652 days, about 10 years-ish, 1970-ish instead of
; 1980, plus an adjustment for leap days past
; our #days calculation is now complete.
; we need #days * 24 hrs a day * 60 mins an hour * 60 seconds a min
; to compute it in seconds.. We'll see it here.
00023495: 25FFFF0000 and eax,00000FFFF
0002349A: 8D1440 lea edx,[eax][eax]*2 ; edx=3*#days
0002349D: 8B45F8 mov eax,[ebp][-0008] ; eax=whour
000234A0: 25FFFF0000 and eax,00000FFFF
000234A5: 8D04D0 lea eax,[eax][edx]*8 ; edx=8*3*#days+wHour
; 24 hrs in a day + wHour here, gives us eax = total # of hours so far since begin date.
000234A8: 8B55FA mov edx,[ebp][-0006] ; edx=wMinute
000234AB: 8BC8 mov ecx,eax
000234AD: 81E2FFFF0000 and edx,00000FFFF
000234B3: C1E104 shl ecx,004 ; ecx=totalhrs*16
000234B6: 2BC8 sub ecx,eax ; make that totalhrs*15
000234B8: 8D048A lea eax,[edx][ecx]*4 ; eax=15*totalhrs*4+wMinute
; 60 mins per hour + minutes, one last * 60 and we should be done.
000234BB: 8B55FC mov edx,[ebp][-0004] ; edx=wSecond
000234BE: 8BC8 mov ecx,eax
000234C0: 81E2FFFF0000 and edx,00000FFFF
000234C6: C1E104 shl ecx,004 ; * 16
000234C9: 2BC8 sub ecx,eax ; * 15
000234CB: 8D048A lea eax,[edx][ecx]*4 ; 15*4*totalsecs+wSecond
; eax = the # of seconds past since some target date.
000234CE: 8B4D08 mov ecx,[ebp][00008]
; and finally, if we've got arg to put this in, put it there, otherwise we'll drop it in eax
000234D1: 85C9 test ecx,ecx
000234D3: 7402 je .0000234D7
000234D5: 8901 mov [ecx],eax
000234D7: 5F pop edi
000234D8: 5E pop esi
000234D9: 5B pop ebx
000234DA: 8BE5 mov esp,ebp
000234DC: 5D pop ebp
000234DD: C3 retn
Not bad, certainly easier than some serial # routines. We can simplify this a bit in C:
GetSystemTime(&st);
adddays=mon2day[st.wMonth]+st.wDay-1;
if ( ! (st.wYear-1980)%4 )
if (st.wMonth>2)
adddays++;
yeardays=st.wYear-1980;
yeardays*=73;
yeardays=(yeardays*4)+(yeardays+adddays);
leapdays=(st.wYear-1980+3)/4;
yeardays+=leapdays;
yeardays+=3652;
mytime = st.wSecond + (st.wMinute*60) + (st.wHour*60*60) + (yeardays*60*60*24);
What's curious here is the adjustments of 3,652 days. This calculation starts with Jan 01, 1980, but then instead gives us 10 years extra. The routine actually calculates the number of UTC seconds since Jan 01, 1970, but the programmer chose to calculate the date from 1980 and then add in the 10 extra years. Doubtless we'll never figure out why, but who cares? It's beat, and that's all that matters.
Add this into our MKSDEMO.C program, along with an appropriate registry change, and we're using MKS toolkit, nagless and forever.
#include <win.h>
main()
{
HWND hwnd;
SYSTEMTIME st;
PHKEY keyhand;
unsigned long mytime;
int mon2day[14]={ 0x0, 0x0, 0x1f, 0x3b, 0x5a, 0x78, 0x97, 0xb5,
0xd4, 0xf3, 0x111, 0x130, 0x14e, 0x16d };
hwnd=CreateWindow("STATIC", "MKS Toolkit Demo", WS_DISABLED|WS_POPUP, 0, 0, 0, 0,
NULL, NULL, NULL, NULL, 0);
SetWindowLong(hwnd,GWL_USERDATA,0x0009edeb);
SetWindowText(hwnd,"MKS Toolkit Demo");
GetSystemTime(&st);
adddays=mon2day[st.wMonth]+st.wDay-1;
if ( ! (st.wYear-1980)%4 )
if (st.wMonth>2)
adddays++;
yeardays=st.wYear-1980;
yeardays*=73;
yeardays=(yeardays*4)+(yeardays+adddays);
leapdays=(st.wYear-1980+3)/4;
yeardays+=leapdays;
yeardays+=3652;
mytime = st.wSecond + (st.wMinute*60) + (st.wHour*60*60) + (yeardays*60*60*24);
RegOpenKeyEx(HKEY_LOCAL_MACHINE,"SOFTWARE\\Mortice Kern Systems\\Toolkit\\DemoVersion",
0, KEY_WRITE, &keyhand);
RegSetValueEx(keyhand,"DemoNumber",0,REG_DWORD,&mytime,sizeof(DWORD));
Sleep(1000);
exit(0);
}
homepage
links
search_forms
+ORC
students' essays
academy database
reality cracking
how to search
javascript wars
tools
anonymity academy
cocktails
antismut CGI-scripts
mail_Fravia
Is reverse engineering legal?