CRACK FOR SIREN MAIL 3.0.0 (32-bit for Windows'95 and NT)
by Greythorne the Technomancer, April 1997
HCU


Courtesy of Fravia's page of reverse engineering
I am using Siren Mail 3.0.0, the executable is called SMWIN.EXE 
and has a size of 1,867,264 bytes. 
You'll find it at Siren's home company page, they have
also a  ftp site (no "register me" to get a copy needed)

Siren Mail is a program very similar to Eudora, with a decent amount 
of functionality.

Run the program and you will see SIREN MAIL TRIAL, a TRIAL COUNTER, 
and a REGISTER button.

Try register and you will get a nice screen that allows you to enter a 
registration number, based on a serial number which is also displayed at the 
top of the window.

What nice possibilities we have here!

Originally I wasn't going to crack this program because someone I know 
had a registered copy at work, with a valid registration key, and needed 
the program installed on a home machine.

No problem I said... I copied down the code, zipped up siren mail, and 
for good measure even made a copy of all .ini files in windows 
(pkzipped of course as INI.ZIP) 
- standard practice for me anyway, because i am sneaky like that. 
hehe.

So I unzipped it on the other machine and ran it. To my surprise, the 
program DID NOT ACCEPT the code that was used at work, on EXACTLY THE 
SAME COPY of itself.

Pretty sneaky of them to foil me like that I thought, so it would seem 
that to crack this damn thing I would need to make a key generator 
(ugh) or crack it outright (my favorite option)

Since dead listing approach worked well for me (last week) when I cracked 
WLCHECK and published the results in +ORC tutorial 4.1 (available on the 
web, for instance here but not with Microsoft exchange :-). 
I decided to go that approach. Besides, I have gotten to quite like the 
win32 disassembler - NEAT PROGRAM!

After using W32DASM7 - which was cracked partially by Frog Prints, and 
finished by me (here it is), I opened up the file 
WS.TXT and scanned for TRIAL MODE

Here is the code I landed in.

:0046D7CE-(THE_COMPARE) 837D0801  cmp [ebp+08], 1		
:0046D7D2 0F850E000000            jne 0046D7E6			

:0046D7D8 6A00                    push 00000000
:0046D7DA 6A00                    push 00000000

* StringData Ref from Data Obj ->"Invalid Registration Number. 
				Program "	<---------- bad invalid data>"will run under trial mode."
                                  |
:0046D7DC 68C09A5700              push 00579AC0
:0046D7E1 E82AB60B00              call 00528E10

notice the compare and jump above...
it looks immedialtely to me like a 'if registered, skip the nasty 
message'and it is.
just change either the compare to ZERO rather than ONE, or
the 0F85 to 0F84 (JNE becomes JE) and now we have cracked 
the registration key screen so that it allows you to enter 
any key (except the RIGHT one however) and exit happily.

Actually, I took it a bit further and decided to make it work for 
any key. I did this because some people i know have registered copies 
for real, and if my cracked version got around, it would matter, 
since even the REAL codes work.

So being the stubborn mule i am, i worked up a fix so that the JNE 
always jumps away. by giving it a 00000001 every time... a 
mov [ebp+08], 1 seems like it would work, but it doesnt matter: 
it takes up too many bytes.

I know a quicker way...
First of all, when a compare of any sort is made, the result is left in 
ax (eax) so we can make eax be what we want.

33 C0	xor eax,eax	(clears eax to zero)
40	inc eax		(adds 1 to it)
90	NOP		(just to fill the extra space)

3 bytes, about as tight as we could write it :)

replacing the 837D0801  with  33C04090 does the trick,
and the JNE goes along on it's merry way.

ANYWAY,
For the sake of getting work done, here is the whole call
courtesy of cut & paste:

Notice that I looked at where all the jumps took me and did a quick 
'find and replace' 0046d752' so that it says GOODBYE.
That helped me alot as you can see how many places it bailed out
of the function. (important to us to see what is going on)

----------------------------------------------------

* Referenced by a CALL at Addresses:
|:0046E46D   , :0046E53F   , :0046E5D9   , :0046E65A   , :0046FCDA   
|
:0046D735 55                      push ebp	<------ START OF CALL :0046D736 8BEC mov ebp, esp :0046D738 83EC04 sub esp, 00000004 :0046D73B 53 push ebx :0046D73C 56 push esi :0046D73D 57 push edi :0046D73E 833D1CB3580000 cmp dword ptr [0058B31C], 00000000 :0046D745 0F8507000000 jne 0046D752 :0046D74B 33C0 xor eax, eax :0046D74D E99B000000 jmp 0046D7ED-(GOODBYE) * Referenced by a Jump at Address:0046D745(C) | :0046D752 A118B35800 mov eax, [0058B318] :0046D757 8945FC mov [ebp-04], eax :0046D75A B90B000000 mov ecx, 0000000B :0046D75F 8B45FC mov eax, [ebp-04] :0046D762 99 cdq :0046D763 F7F9 idiv ecx :0046D765 05AB909600 add eax, 009690AB :0046D76A 8945FC mov [ebp-04], eax :0046D76D 8B45FC mov eax, [ebp-04] :0046D770 39051CB35800 cmp [0058B31C], eax :0046D776 0F850F000000 jne 0046D78B :0046D77C B801000000 mov eax, 00000001 :0046D781 E967000000 jmp 0046D7ED-(GOODBYE) :0046D786 E962000000 jmp 0046D7ED-(GOODBYE) * Referenced by a Jump at Address:0046D776(C) | :0046D78B 8145FC020E0000 add [ebp-04], 00000E02 :0046D792 8B45FC mov eax, [ebp-04] :0046D795 39051CB35800 cmp [0058B31C], eax :0046D79B 0F852D000000 jne 0046D7CE-(THE_COMPARE) :0046D7A1 833D28B3580000 cmp dword ptr [0058B328], 00000000 :0046D7A8 0F8520000000 jne 0046D7CE-(THE_COMPARE) :0046D7AE C7052CB3580000000000 mov dword ptr [0058B32C], 00000000 :0046D7B8 C70528B3580001000000 mov dword ptr [0058B328], 00000001 :0046D7C2 E881FCFFFF call 0046D448 :0046D7C7 33C0 xor eax, eax :0046D7C9 E91F000000 jmp 0046D7ED-(GOODBYE) * Referenced by a Jump at Addresses:0046D79B(C), :0046D7A8(C) | :0046D7CE-(THE_COMPARE) 837D0801 cmp [ebp+08], 1 <---- if it is NOT a 1, :0046D7D2 0F850E000000 jne 0046D7E6 <---- jump past bad code "(SAY.class" tppabs="http://Fravia.org/(SAY.class" I AM REGISTERED) :0046D7D8 6A00 push 00000000 :0046D7DA 6A00 push 00000000 * StringData Ref from Data Obj>"Invalid Registration Number. 
				Program "	<--- bad invalid data "will run under trial mode." | :0046D7DC 68C09A5700 push 00579AC0 :0046D7E1 E82AB60B00 call 00528E10 * Referenced by a Jump at Address:0046D7D2(C) | :0046D7E6 33C0 xor eax, eax <------ clear and exit :0046D7E8 E900000000 jmp 0046D7ED-(GOODBYE) * Referenced by a Jump at Addresses:0046D74D(U), :0046D781(U), :0046D786(U), :0046D7C9(U), :0046D7E8(U) | :0046D7ED 5F pop edi (GOODBYE) :0046D7EE 5E pop esi :0046D7EF 5B pop ebx :0046D7F0 C9 leave :0046D7F1 C3 ret Running the program still shows a problem, however. A hurdle has been passed that allows us to enter any data on the registration screen, but it still isnt registered! We still get the stupid trial counter and in big letters we see SIREN MAIL TRIAL. We don't like that... do we. Scanning for either of those in our dead listing, we land HERE: * StringData Ref from Data Obj>"Siren Mail Trial"	<--- BAD TRIAL MESSAGE | :0046E4D0 68449C5700 push 00579C44 :0046E4D5 8B4DE8 mov ecx, [ebp-18] :0046E4D8 81C1D4000000 add ecx, 000000D4 :0046E4DE E86C220B00 call 0052074F * StringData Ref from Data Obj>"Trial Count:"
                                  |
:0046E4E3 68589C5700              push 00579C58
:0046E4E8 8B4DE8                  mov ecx, [ebp-18]
:0046E4EB 83C15C                  add ecx, 0000005C
:0046E4EE E85C220B00              call 0052074F
:0046E4F3 A12CB35800              mov eax, [0058B32C]
:0046E4F8 50                      push eax

We have to backtrack a bit more than in the first try to find 
our comparison, but here it is:

:0046E475 83F801                  cmp eax, 1		AM I REGISTERED?
:0046E478 0F8552000000            jne 0046E4D0	IF NOT, JUMP DISPLAY 
						TRIAL NOTICE ON NAGSCREEN

* StringData Ref from Data Obj ->"Siren Mail"	<----- good screen | :0046E47E 68209C5700 push 00579C20 :0046E483 8B4DE8 mov ecx, [ebp-18] :0046E486 81C1D4000000 add ecx, 000000D4 :0046E48C E8BE220B00 call 0052074F * StringData Ref from Data Obj>"Registration Key:"
                                  |
:0046E491 682C9C5700              push 00579C2C

Crack it as we did above.

0F85 -> 0F84     or     00000001 -> 00000000
or even 33C040 like I showed you for a more stylistic
and better crack.

Coupled with the previous crack of the registration screen above, 
we have cracked our naggers, but something bothers me about
a two-part crack that removes visible signs of a protection scheme.
----------------------------------------------------------------------------

Again, to make life easier on you, here is the full call from
beginning to end:

* Referenced by a CALL at Addresses:0046E60B   , :0046F3CB   
|
:0046E45F 55                      push ebp
:0046E460 8BEC                    mov ebp, esp
:0046E462 83EC18                  sub esp, 00000018
:0046E465 53                      push ebx
:0046E466 56                      push esi
:0046E467 57                      push edi
:0046E468 894DE8                  mov [ebp-18], ecx
:0046E46B 6A00                    push 00000000
:0046E46D E8C3F2FFFF              call 0046D735	
:0046E472 83C404                  add esp, 00000004
	
:0046E475 83F801                  cmp eax, 1		AM I REGISTERED?
:0046E478 0F8552000000            jne 0046E4D0	IF NOT, DISPLAY 
						TRIAL NOTICE ON NAGSCREEN

* StringData Ref from Data Obj ->"Siren Mail"	<----- GOOD SCREEN | :0046E47E 68209C5700 push 00579C20 :0046E483 8B4DE8 mov ecx, [ebp-18] :0046E486 81C1D4000000 add ecx, 000000D4 :0046E48C E8BE220B00 call 0052074F * StringData Ref from Data Obj>"Registration Key:"
                                  |
:0046E491 682C9C5700              push 00579C2C
:0046E496 8B4DE8                  mov ecx, [ebp-18]
:0046E499 83C15C                  add ecx, 0000005C
:0046E49C E8AE220B00              call 0052074F
:0046E4A1 A11CB35800              mov eax, [0058B31C]
:0046E4A6 50                      push eax

* StringData Ref from Data Obj ->"%ld"
                                  |
:0046E4A7 68409C5700              push 00579C40
:0046E4AC 8D45EC                  lea eax, [ebp-14]
:0046E4AF 50                      push eax

* Reference To: USER32.wsprintfA, Ord:0249h
                                  |
:0046E4B0 FF15D40F5900            Call dword ptr [00590FD4]
:0046E4B6 83C40C                  add esp, 0000000C
:0046E4B9 8D45EC                  lea eax, [ebp-14]
:0046E4BC 50                      push eax
:0046E4BD 8B4DE8                  mov ecx, [ebp-18]

* Reference to Dialog: DialogID_0098 
                                  |
:0046E4C0 81C198000000            add ecx, 00000098
:0046E4C6 E884220B00              call 0052074F
:0046E4CB E94D000000              jmp 0046E51D

* Referenced by a  Jump at Address:0046E478(C)
|

* StringData Ref from Data Obj ->"Siren Mail Trial"	<----bad TRIAL MESSAGE | :0046E4D0 68449C5700 push 00579C44 :0046E4D5 8B4DE8 mov ecx, [ebp-18] :0046E4D8 81C1D4000000 add ecx, 000000D4 :0046E4DE E86C220B00 call 0052074F * StringData Ref from Data Obj>"Trial Count:"
                                  |
:0046E4E3 68589C5700              push 00579C58
:0046E4E8 8B4DE8                  mov ecx, [ebp-18]
:0046E4EB 83C15C                  add ecx, 0000005C
:0046E4EE E85C220B00              call 0052074F
:0046E4F3 A12CB35800              mov eax, [0058B32C]
:0046E4F8 50                      push eax

* StringData Ref from Data Obj ->"%d"
                                  |
:0046E4F9 68689C5700              push 00579C68
:0046E4FE 8D45EC                  lea eax, [ebp-14]
:0046E501 50                      push eax

* Reference To: USER32.wsprintfA, Ord:0249h
                                  |
:0046E502 FF15D40F5900            Call dword ptr [00590FD4]
:0046E508 83C40C                  add esp, 0000000C
:0046E50B 8D45EC                  lea eax, [ebp-14]
:0046E50E 50                      push eax
:0046E50F 8B4DE8                  mov ecx, [ebp-18]

* Reference to Dialog: DialogID_0098 
                                  |
:0046E512 81C198000000            add ecx, 00000098
:0046E518 E832220B00              call 0052074F

* Referenced by a  Jump at Address:0046E4CB(U)
|
:0046E51D 6A00                    push 00000000
:0046E51F 8B4DE8                  mov ecx, [ebp-18]
:0046E522 E83B190B00              call 0051FE62
:0046E527 E900000000              jmp 0046E52C

* Referenced by a  Jump at Address:0046E527(U)
|
:0046E52C 5F                      pop edi
:0046E52D 5E                      pop esi
:0046E52E 5B                      pop ebx
:0046E52F C9                      leave
:0046E530 C3                      ret
-----------------------------------------------

Now, what we have done is two important cosmetic 
changes to the program, which now
1) allows you to enter any registration code you like, and
2) does not display a TRIAL VERSION notice  on the main screen

What if there are hidden parts to this we don't know of?
There may be, there may not. Regardless, we have to make 2 
changes in the software to effect an 'after the fact' crack. 
In other words, we have only found the results of the 
crack and removed them. If there are other results that we 
haven't found, then there would be a problem, and the crack 
would not be complete.

To make sure, I figured that the MAKE IT REGISTERED code was 
somewhere nearby, go figure: we originally looked in the ENTER 
YOUR REG CODE call, and found a way to disable the nagscreen 
that came with it... but if we could do that, why not look at 
that piece of code a little further... if we can enter a code 
there, we SHOULD BE ABLE to make it register there.

Looking at the call again from the top... this time seeking 
some basic compares or suspicious values being set:

* Referenced by a CALL at Addresses:0046E46D, :0046E53F, 
				:0046E5D9, :0046E65A, :0046FCDA   
|
:0046D735 55                      push ebp			
:0046D736 8BEC                    mov ebp, esp
:0046D738 83EC04                  sub esp, 00000004
:0046D73B 53                      push ebx
:0046D73C 56                      push esi
:0046D73D 57                      push edi

:0046D73E 833D1CB3580000          cmp dword ptr [0058B31C], 0	
:0046D745 0F8507000000            jne  0046D752	
:0046D74B 33C0                    xor eax, eax				
:0046D74D E99B000000              jmp 0046D7ED-(GOODBYE)					

The compare 0 looks interesting, notice the xor which resets eax 
to zero? Changing the JNE to a JE (0F 85 becomes 0F 84) results in 
something we had accomplished before... it ALSO allows acceptance 
of any value on the screen where we typed in a sample registration 
code.

That didnt do us any good. See, but that isn't a 00000001 is it? 
and our codes have been checking for a value of 1 which is what the 
registered flag should be (have you been following? :)

Go on down just a little farther and you will hit a MUCH NICER 
fellow... 

:0046D770 39051CB35800            cmp [0058B31C], eax	
:0046D776 0F850F000000            jne 0046D78B		
:0046D77C B801000000              mov eax, 00000001		
:0046D781 E967000000              jmp 0046D7ED-(GOODBYE)	
:0046D786 E962000000              jmp 0046D7ED-(GOODBYE)

whereas before you had compares to 00000001, this one MAKES eax
= to 1. This, my dear friends, is the main registered-version 
flag setter! Want to test for yourself? go for it :)

Changing the JNE from 0F85  to 0F84 cracks it completely!
(In my copy i still do the 33C040  changes on top of this since
they allow even good codes to work - just my style I guess ;)
So then here is the complete crack for this program:
*******************************************************
Crack for Siren Mail 3.0 by Greythorne The Technomancer
(April 1997)
find this data: 051CB358000F850F
change it to: 051CB358000F840F
*******************************************************

Enterprising crackers may want to make a fix for the compare
using XOR's instead for a better crack - I did ;)

33C0 33C0 33C0	 (this clears EAX 3 times in order to fill 
		  the 6-byte space where the compare was)

Another thing:
the crack location with the compare, compares the REAL ECHO at the 
point of breaking... in other words, i ran sirenmail (unregistered) 
and breakpointed on MESSAGEBOXA in order to break into the program 
at any old point because it seems to be a 1 to 1 exact comparison 
between this program and wdasm's output...
the location :0046D770 in W32DASM7 is EXACTLY  0137:0046D770 inside 
softice... even if it wasnt, you could enter a 00 in the hex editor 
at the crack location compare and softice would trap it there anyway 
(GPF, but it works nonetheless)

Now, bpx on 0137:0046d76d (the compare as seen below)
:0046D76D 8B45FC                mov eax, [ebp-04]
:0046D770 39051CB35800          cmp [0058B31C], eax  <-- you are here :0046D776 0F850F000000 jne 0046D78B :0046D77C B801000000 mov eax, 00000001 :0046D781 E967000000 jmp 0046D7ED-(GOODBYE) :0046D786 E962000000 jmp 0046D7ED-(GOODBYE) and if you now type this: ?eax it will display the REAL reg code, mine is 78619753, but it wont matter to anyone else since the code "changes.class" tppabs="http://Fravia.org/changes.class" per system. So that is where to look to make a key generator.

Let's make a key generator!


looking back at the code of the compare we just looked at,
we see the mathematical part of the protection routine 
(important code is explained)

:0046D752 A118B35800     mov eax, [0058B318]	;get the program's serial number
:0046D757 8945FC         mov [ebp-04], eax	;(store serial number)
:0046D75A B90B000000     mov ecx, 0000000B	;ecx becomes B (11 in deximal)
:0046D75F 8B45FC         mov eax, [ebp-04]	;(get serial number)
:0046D762 99             cdq	               ;(doesn't seem to do anything)

:0046D763 F7F9           idiv ecx		;divide eax (serial num) by ecx (11)
:0046D765 05AB909600     add eax, 009690AB	;add this number to eax

:0046D76A 8945FC        mov [ebp-04], eax    ;(store new code)
:0046D76D 8B45FC        mov eax, [ebp-04]	;(get new code)

:0046D770 39051CB35800  cmp [0058B31C], eax	;compare new code to your typed one

NOW WE KNOW WHAT THE MATH OF THE PROTECTION IS
simply: serial number / B(hex) + 9690AB(hex)
that's it! The key generator is therefore:
************************************************************
#include 
int main()  /* compiled with borland c/c++ 4.5 */
{
        unsigned long code;
        printf("Keymaker for SIREN MAIL 3.0.0 / 32-bit\n");
        printf("By Greythorne the Technomancer - April 1997\n\n");
        printf("Enter your serial number (do not include dashes): ");
        scanf("%U",&code);
        printf("Creating key for %lu\n",code);
        code = code / 0x0B;
        code = code + 0x9690AB;
        printf("Your code is %lu\n",code);
}
*************************************************************
For the softice guys out there: it is easy enough to breakpoint
on the start of the code, step through each step one by one and
check eax at each point (and the data locations) so it is simple
to determine what values do what for us.
I hope this work shows the possibilities one can grasp with the 
dead listing methode, and then some :)


After all this, is there something else I could do to crack this better?
I get to show you how to make this program become its own key generator!!!

To do this we must look at two places in particular;
The code generator itself, and the registration screen that displays the
registration code.

HERE IS THE CODE GENERATION ROUTINE AGAIN:

:0046D752 A118B35800     mov eax, [0058B318]    ;get the program's serial number
:0046D757 8945FC         mov [ebp-04], eax      ;(store serial number)
:0046D75A B90B000000     mov ecx, 0000000B      ;ecx becomes B (11 in deximal)
:0046D75F 8B45FC         mov eax, [ebp-04]      ;(get serial number)
:0046D762 99             cdq                    ;(doesn't seem to do anything)

:0046D763 F7F9           idiv ecx               ;divide eax (serial num) by ecx (11)
:0046D765 05AB909600     add eax, 009690AB      ;add this number to eax

:0046D76A 8945FC        mov [ebp-04], eax    ;(store new code)
:0046D76D 8B45FC        mov eax, [ebp-04]    ;(get new code)

:0046D770 39051CB35800  cmp [0058B31C], eax     ;compare new code to your typed one 
    The real code is in eax, and the one you typed in is at [0058b31c]
(note that compares erase eax so the code is lost after this line is 
executed)

:0046D776 0F850F000000  jne 0046d78B	; jumps away if eax not zero
:0046D77C b801000000  mov eax, 1		;registers the program

...AND HERE AGAIN IS THE IMPORTANT DATA FROM THE REG SCREEN:

* StringData Ref from Data Obj ->"Registration Key:"
                                  |
:0046E491 682C9C5700          push 00579C2C
:0046E496 8B4DE8              mov ecx, [ebp-18]
:0046E499 83C15C              add ecx, 0000005C
:0046E49C E8AE220B00          call 0052074F
:0046E4A1 A11CB35800          mov eax, [0058B31C] <- read data looking at the code "above,.class" tppabs="http://Fravia.org/above,.class" we know that the data here is really only what you typed in, not the echo of the real code in memory. So how do we get the program to :0046D770 39051CB35800 cmp [0058B31C], eax ;compare new code to your typed one (this is a 6 byte compare) and change it to: mov [0058B31C],eax (now the memory location holds the REAL code and not what YOU typed) which is: A31CB35800 it turns out to be 5 bytes so that we need a NOP to fix it to be 6 and not cause some weird error to crash siren here. SO WE REPLACE : 39051CB35800 WITH: A31CB3580090 but now we have just the little problem of the JNE as seen below: :0046D776 0F850F000000 jne 0046d78B ; jumps away if eax not zero :0046D77C b801000000 mov eax, 1 ;registers the program since eax is nonzero (holds our REAL code) it always leaves and fails registration... change the 0F85 to 0F84 to make it a JZ and it registers fine and we have killed 2 birds with one stone... NOT ONLY does the program register, it ALSO becomes its own key generator! run it and see no matter what you type in the register window, you get the real code every time displayed in the title screen! **************************************************** BEST CRACK FOR SIREN MAIL 3.0.0 32-Bit By Greythorne the Technomancer CHANGE: 39051CB358000F85 TO: A31CB35800900F84 **************************************************** Now, I am really done! This program has been cracked to hell and back... with wondrous results! Looking back on it, we have done several crack methods: 1) a simple crack by disabling the RESULTS of the unregistered version 2) a better crack by registering the program outright a) for people with any code but the correct one b) then for people with ANY code, even correct ones 3) making a key generator by tracing through the math and seeing what it does making sure to remember that for harder programs (see instant access) it is best to use softice and watch the data manipulations line by line until the final code is generator 4) making a better-than-professional level crack that not only registers the software but also becomes its own key generator I do hope this lesson has been good to you, it has been quite a ride for me since the other day when i started it. Good luck, keep cracking, and above all HAVE FUN! +gthorne'97
Thank you for tuning in!
+gthorne'97

+gthorne 1997. All rights reversed.

You are deep inside Fravia's page of reverse engineering, choose your way out:

homepage links red anonymity +ORC students' essays
academy database tools cocktails search_forms mail_Fravia