|
|
Solution
Well, first let's take IDA to create a listing. If you don't have one and REme1 is really immune to W32Dasm you'll have to believe me on offsets I provide...
1) The easiest thing I suppose is change the caption of a button to "Reversed" :)
Let's do this:
1) Open Hiew
2) Goto .00403037
3) Change Not Reversed to - Reversed -
2) Second let's do some reversing... In IDA I've found the message cycle and at offset 004011A1 I found what I was looking for:
Checking for WM_COMMAND. But the only WM_COMMAND we have is fromt the button, don't we? ;)
Now, as we have found it what do we see?
Here there is wParam moved into eax(4011AE), and then lParam is checked to be NULL
If it is NULL then it hasn't been sent by the button and thus we should show some other message(eg. "Edit Box Is Good Mmmmkay ?") as it is here...
But before that we have a tricky check, if ax!=1 then check other...
Let's go further. Now, we have an ax checking. Do you wonder what that does mean? Ok, let's see in MSDN:
The high-order word specifies the notification code if the message is from a control. If the message is from an accelerator, this value is 1. If the message is from a menu, this value is zero.
The low-order word specifies the identifier of the menu item, control, or accelerator.
Now we have a low-order word, don't we? Thus it is checking the identifier, let's open the resource editor and examine the identifiers...
Stop, but we don't have any resources here, except for Icon. So, what can this identifier be?
Gotcha, when we create window the third value pushed is:
HMENU hMenu // menu handle or child identifier
So here is our identifier. Yes and button has 1, edit box has 2, and the parent window has 0
Things become clearer. Now we can found what happens when we press the button!
Here is the code:
00401304 push 0
00401306 push 3
00401308 push 111h
0040130D push dword ptr [ebp+8]
00401310 call j_SendMessageA
That is after all the checking we send a message from a non-existant control. And thus we have lParam==0 and ax!=1 => from here:
004011BB cmp ax, 1
004011BF jnz short loc_4011EA
we jump to 004011EA. And what do we find out?
00401202 cmp ax, 3
00401206 jnz loc_4012EC
0040120C mov eax, offset loc_40123B
00401211 jmp eax
So after all the jumps the real reactions is at 40123B. Let's examine it:
0040123B push 0
0040123D push offset aParabytesReverseme1 ; "ParaBytes ReverseMe #1"
00401242 push offset aOkayForNowMissionFailed ; "Okay, for now, mission failed !"
00401247 push 0
00401249 call near ptr a@
0040124E push 200h
00401253 push offset buffer
00401258 push hEditBox
0040125E call j_GetWindowTextA
00401263 mov ecx, eax
00401265 xor edx, edx
00401267 or ebx, 0FFFFFFFFh
0040126A inc ebx
0040126B mov eax, offset buffer
Here we get this message. And I think that call near ptr a@ leads to MessageBoxA, so let's nop it! And in hiew it is really seen as call MessageBoxA, so let's do it! ;)
Ecx now contains the length of the string!
But before that we have the following snippet:
00401213 push 200h
00401218 push offset buffer
0040121D push hEditBox
00401223 call j_GetWindowTextA
00401228 push 0
0040122A push offset aParabytesReverseme1 ; "ParaBytes ReverseMe #1"
0040122F push offset buffer
00401234 push 0
00401236 call j_MessageBoxA
So we should nop jmp eax at 401211, so that it would show the string we entered...
Another thing done(I mean 2) remove the "mission failed" and 3) regain access to the messgaebox that shows what you entered)
I think it will end rather soon.
00401270 loc_401270: ; CODE XREF: .text:00401293j
00401270 mov bl, [eax] ; get the char of the string in edit box
00401272 cmp byte ptr [eax], 0 ; is it end?
00401275 jz short CHECK
00401277 cmp byte ptr [eax], 30h ; is it <0?
0040127A jl short CHECK
0040127C cmp byte ptr [eax], 39h ; is it >9?
0040127F ja short CHECK
00401281 add edx, ebx
00401283 shl edx, 14h
00401286 add edx, ecx
00401288 inc eax
00401289 add ecx, 0FFFFFFFFh
0040128C test edx, edx
0040128E jnz short loc_401291
00401290 inc edx
00401291
00401291 loc_401291: ; CODE XREF: .text:0040128Ej
00401291 test ecx, ecx
00401293 jnz short loc_401270 ; get the char of the string in edit box
00401295
00401295 CHECK: ; CODE XREF: .text:00401275j
00401295 ; .text:0040127Aj
00401295 ; .text:0040127Fj
00401295 test edx, 0
0040129B jg short loc_4012B6
0040129D jz short loc_4012CB
0040129F push 0
004012A1 push offset aParabytesReverseme1 ; "ParaBytes ReverseMe #1"
004012A6 push offset aThatNotANumberCheather ; "That not a number ! CHEATHER !"
004012AB push 0
004012AD call near ptr a@ ; "\xFF% @"
004012B2 leave
004012B3 retn 10h
004012B6 ; ---------------------------------------------------------------------------
004012B6
004012B6 loc_4012B6: ; CODE XREF: .text:0040129Bj
004012B6 jmp short locret_4012E0
004012B8 ; ---------------------------------------------------------------------------
004012B8 push 0
004012BA push offset aParabytesReverseme1 ; "ParaBytes ReverseMe #1"
004012BF push offset aGoodNumber ; "Good Number"
004012C4 push 0
004012C6 call near ptr a@ ; "\xFF% @"
004012CB
004012CB loc_4012CB: ; CODE XREF: .text:0040129Dj
004012CB jmp short locret_4012E0
004012CD ; ---------------------------------------------------------------------------
004012CD push 0
004012CF push offset aParabytesReverseme1 "ParaBytes ReverseMe #1"
004012D4 push offset aBadNumber ; "Bad Number"
004012D9 push 0
004012DB call near ptr a@ ; "\xFF% @"
004012E0
004012E0 locret_4012E0: ; CODE XREF: .text:004012B6j
004012E0 ; .text:004012CBj
004012E0 leave
004012E1 retn 10h
It really gets harder now. Here we have a number checking routine, not char, so we'll have to rewrite it...
Anyway let's first change "Good number" to "Good Serial" and "Bad Number" to "Bad Serial"...
We'll use hiew, as you could have guessed...
Have you changed, now let's get on with the reversing!
Let's do it this way:
If we don't want to add imports, then we should check the byte checking!
We will also have to add a "ParaB0y" string to the file...
Let's make a backup first and do it!!!
Doing...Doing...Doing... :)
"ParaB0y" will be at offset 403100...
It would look this way:
mov eax,4030CC
mov ecx,403100
Loop:
cmp [ecx],0
jz End
mov bl,[eax]
mov bh,[ecx]
cmp bh,bl
jnz Error
inc ecx
inc eax
jmp Loop
End:
cmp [eax],0
jg Error
jmp 401295
Error:
mov edx,1
What does this snippet do. It compares each byte. If the "ParaB0y" string ends then we check if the buffer string ended, too. If it does, then there are no more other chars in the string
and the serial is right. Otherwise, edx=1...
Then change
0040129B jg short loc_4012B6
to
0040129B jg 4012CD
and
0040129D jz short loc_4012CB
to
0040129D jz 4012B8
We should change test edx, 0 to cmp edx,0 and nop all from 401213 to 401295...
The full source of the snippet with offsets, mine at least is:
0040123B loc_40123B: ; DATA XREF: sub_401110+FCo
0040123B mov eax, offset buffer
00401240 mov ecx, offset aParab0y ; "ParaB0y"
00401245
00401245 Loop: ; CODE XREF: sub_401110+144j
00401245 cmp byte ptr [ecx], 0
00401248 jz End
0040124A mov bl, [eax]
0040124C mov bh, [ecx]
0040124E cmp bh, bl
00401250 jnz Error
00401252 inc eax
00401253 inc ecx
00401254 jmp Loop
00401259 ; ---------------------------------------------------------------------------
00401259
00401259 End: ; CODE XREF: sub_401110+138j
00401259 cmp byte ptr [eax], 0
0040125C jg short loc_401263
0040125E jmp loc_401270
00401263 ; ---------------------------------------------------------------------------
00401263
00401263 Error: ; CODE XREF: sub_401110+140j
00401263 ; sub_401110+14Cj
00401263 mov edx, 1
00401268 jmp loc_401295
00401268 ; ---------------------------------------------------------------------------
0040126D align 4
00401270
00401270 loc_401270: ; CODE XREF: sub_401110+14Ej
00401270 xor edx, edx
00401272 nop
00401273 nop
00401274 nop
00?????? ...
00401292 nop
00401293 nop
00401294 nop
00401295
00401295 loc_401295: ; CODE XREF: sub_401110+158j
00401295 cmp edx, 0
00401298 nop
00401299 nop
0040129A nop
0040129B jnz short loc_4012CD ;Bad serial
0040129D jmp loc_4012B8 ;Good serial
Ok, guys that's it. Reverseme complete. It took me 1,5 hour to complete it. This solution was being written during the reversing itself.
So it can contain some useless actions, but that's how I did it.