Reverse Code Engineering - Action Player v3.0
A Cheater's Key Generator
Author: Volatility
http://www.ImmortalDescendants.com
03/06/99

Please Read The Disclaimer Before Continuing.
Please don't e-mail me about an invalid program location.  Locations change.
If you don't know how to file search, you shouldn't be reversing.


Target Action Player v3.0 - (actplay.zip) - 181,219 bytes
Location http://filedudes.ionsys.com/win95/audioap/files/actplay.zip
Protection(s) User Name/Serial Number
Tools Needed Regmon
Wdasm
Hiew (Or Hex Editor Of Your Choice)
Level (X) Beginner ( ) Intermediate ( ) Advanced ( ) Expert

Initially, I thought this program would be a bit tougher to bust.  Even upon disassembly, it looked like I'd need to patch in at least a couple areas.  But, as you'll see, we need only change one byte, and in the process (was a pleasant surprise to me), we force the program to give us our PROPER serial number :)

Prepare To Crack

Let's gather a bit of information about our target first (you'll see why later).  Open Regmon, and if an initial screen doesn't greet you, you'll need to choose "Filter" from the "Options" menu item.  Type "Actionpl" into the "Process Include(s)" box (this is the handle of the program).

Run the program, then close it right away.  Now we can look at the data in Regmon, to see if anything interests us.  There are quite a few lines, but the two areas that interest us are as follows:
 
14      Actionpl        QueryValueEx    HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\UserName    SUCCESS         
15      Actionpl        QueryValueEx    HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\UserName    SUCCESS ""      
and
24      Actionpl        QueryValueEx    HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\RegCode     SUCCESS         
25      Actionpl        QueryValueEx    HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\RegCode     SUCCESS ""      

We now know that this program utilizes the Windows 95 registry to store our information.  Two keys will be required -- HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\UserName and HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\RegCode.  Remember this for later.  (I'm wondering where "Slackerz 'R' Uz" came from -- wonder if he was referring to his protection?)

Make The Crack

Load the program into Wdasm ("Disassemble", "Open file to disassemble").  Once your dead-listing is complete, open the SDR window ("Refs", "String Data References").  Look for anything of interest -- the most promising is obviously "Thank you for registering ActionPlayer".  Double click on this string, and you'll land here:
 
* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:004051B9(U)
|
:004051C0 85C0                    test eax, eax          :Compare your serial with correct one
:004051C2 6A00                    push 00000000
:004051C4 7578                    jne 0040523E           :Jump if not equal to Unregistered

* Possible StringData Ref from Data Obj ->"Confirmed"
                                  |
:004051C6 68D0054300              push 004305D0          :Pretty self-explanatory :)

* Possible StringData Ref from Data Obj ->"Thank you for registering ActionPlayer"
                                  |
:004051CB 68A8054300              push 004305A8

Since we saw in Regmon that the registration information is stored in the registry, I assumed patching the conditional jump above would give me the "Thank you..." message, but that I'd still need to reverse the registry access routine in order to make the program accept any information I entered.  I was wrong!!!

Highlight the line "jne 0040523E" and get the offset from below (should be 000045C4h (45C4)).  Make a copy of the program, and open it in HIEW.

1)  Press F4 to get to hex view
2)  Press F5 to search
3)  Enter the offset (45C4)
4)  Press F2 to get to code view
5)  Press F3 to edit
6)  Change 7578 to 7478 (jne to je)

Now you can register the program with any information.  As usual, I assumed this was just the first part of the crack, but upon closing and restarting the program, I was still registered!!!  We also know where our registration information is stored now, because of our preparations with Regmon.

So, open up regedit, and find the proper key (HKCU\Software\Slackerz 'R' Uz\ActionPlayer\Settings\), and there it is, our correct serial number  -- we've successfully created a "Slackerz" key generator :)


*** Disclaimer ***
This Essay Is For Knowledge Purposes Only. Neither We, Our ISP, Nor Any Persons Mentioned Shall Be Held Liable For Any Damages Improper Usage May Cause To Your Machine.

If You Successfully Crack A Program, You Must Delete It Immediately. If You Want To Keep The Program, Please BUY It! Support Shareware, This Is Our Learning Tool!

It Is Illegal To Continue To Use Cracked/Patched Software.


Copyright © 1999 Volatility And The Immortal Descendants. All Rights Reserved.
E78030000 or esi, 00000378