*****************************************************************************
*Subject: Cracking							    *
*Target: Qoole 2.50 (Quake II editor)	    				    *
*Author: BlackB								    *
*Date: 1999-02-14							    *
*Tools used: W32DSM89, HEX WORKSHOP 2.54				    *
*Difficulty (scale 1-5): 2						    *
*Requirements: Basic knowledge of cracking				    *
*****************************************************************************

1. Introduction
~~~~~~~~~~~~~~~

Hi there! This is my first tutorial on cracking. I've been cracking for 2
months now, and it works out quite well! I've 'registered' quite some 
programs in those 2 months and I started to think: why not writing an easy
to understand tutorial.....well here I am.....enjoy :-)

If you're interested (probably not): I'm 17, live in Belgium, and my 
computer"knowledge" covers Assembler, Pascal, viruses, IRC(war), cracking,
etc... .
Enough lameness...let's crack!

2. Qoole 2.50
~~~~~~~~~~~~~

In my (modest) opinion, Qoole is the best Quake II editor available. Of
course, if u download it from www.qoole.com, the version is shareware: u can
use it for 14 days only (don't know if Qoole checks this) and there's a 300
brush limit....not enough for big levels! So.....it had to be cracked :-)
When I first ran the program, I saw a nice registering screen that asked for
a username and serial. And I thought: "Oh, this 's gonna be easy". So I 
started to "bpx getdlgitemtexta" and "bpx getwindowtexta".......unfortunately
Qoole uses its own procedures, so Softice didn't pop. (if u don't know what
Softice and/or bpx is then stop reading this tutorial and start learning 
about cracking tools)
Finding the serial didn't work out as I expected....so I gave it a try with
W32DSM89....

- Run GlideQoole, click Options-Register Qoole.
- Fill in a bogus user and serial
- Click OK and write the following message down: "Invalid registration code"

Interesting :) The string will probably be in the disassembly file:

- Run W32DSM89, disassemble GlideQoole.exe
- Click Search-Find text
- Type "Invalid registration" and click "Find next"

The only thing we have to do is that Qoole doesn't execute the "Invalid
registration..." (without actually deleting the message of course!) So let's
look above if we can find some je/jne instructions...

---------------------------Start of partial code-----------------------------

:0040DAC3 83C242                  add edx, 00000042
:0040DAC6 3BCA                    cmp ecx, edx
:0040DAC8 7544                    jne 0040DB0E <- *First jump instruction*
:0040DACA 0FBE4DA7                movsx ecx, byte ptr [ebp-59]
:0040DACE A164854C00              mov eax, dword ptr [004C8564]
:0040DAD3 99                      cdq
:0040DAD4 BE1A000000              mov esi, 0000001A
:0040DAD9 F7FE                    idiv esi
:0040DADB 83C241                  add edx, 00000041
:0040DADE 3BCA                    cmp ecx, edx 
:0040DAE0 752C                    jne 0040DB0E <- *Second jump instruction*
:0040DAE2 6A04                    push 00000004
:0040DAE4 8D55D0                  lea edx, dword ptr [ebp-30]
:0040DAE7 52                      push edx
:0040DAE8 8D45C8                  lea eax, dword ptr [ebp-38]
:0040DAEB 50                      push eax
:0040DAEC E88FD80800              call 0049B380
:0040DAF1 83C40C                  add esp, 0000000C
:0040DAF4 85C0                    test eax, eax
:0040DAF6 7516                    jne 0040DB0E <- *Third jump instruction*
:0040DAF8 6A04                    push 00000004
:0040DAFA 8D4DF4                  lea ecx, dword ptr [ebp-0C]
:0040DAFD 51                      push ecx
:0040DAFE 8D55C0                  lea edx, dword ptr [ebp-40]
:0040DB01 52                      push edx
:0040DB02 E879D80800              call 0049B380
:0040DB07 83C40C                  add esp, 0000000C
:0040DB0A 85C0                    test eax, eax
:0040DB0C 7467                    je 0040DB75 <- *Fourth jump instruction*

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:0040DAC8(C), :0040DAE0(C), :0040DAF6(C)
|

* Possible StringData Ref from Data Obj ->"qoole.reg"
                                  |
:0040DB0E 68A8514B00              push 004B51A8
:0040DB13 E838D80800              call 0049B350
:0040DB18 83C404                  add esp, 00000004

* Possible StringData Ref from Data Obj ->"Invalid registration code"

---------------------------End of partial code-------------------------------

To avoid the "Invalid registration code" message, a jump should be beyond
0040DB18. So lets change all four the jump instructions to there opposits:
- jne=75 => 74
- je=74 => 75

Final result:

:0040DAE0 742C                    je 0040DB0E <- first jump
:0040DAE0 742C                    je 0040DB0E <- second jump
:0040DAF6 7416                    je 0040DB0E <- third jump
:0040DB0C 7567                    jne 0040DB75<- fourth jump

Change the instructions in Hex Workshop or another hex editor and save the
changes. (if u don't know how to work with a hex editor....learn!)

Optimistic that we are, we think we cracked Qoole......so we re-run Qoole,
type a bogus name and serial....click ok and...."Qoole registered, thanks! 
(Qoole.reg created)". YES, it's cracked...........naaaaaaah no way!! Before
you click OK, you can know it won't work:

-it's obvious that if Qoole creates a .REG file with our (wrong) 
 name and decoded serial, it'll check the reg file every time Qoole 
 is executed and will give an error.....even worse, it checks the
 .REG file just after you've registered!

-Click OK and......."Bad registration key file". U have to click OK and the
program exits.
-Restart GlideQoole....it'll give the same message and delete the bad ..REG
-Restart GlideQoole.......it works again, but isn't registered.

Okay, there is a procedure that checks the qoole.reg file. Let's get back to
W32DSM89 and let's search for "Bad registration key file". You should see
this:

---------------------------Start of partial code-----------------------------
* Referenced by a CALL at Addresses:
|:0040E423   , :0040E43D   , :0040E457   , :0040E4EE   , :0040E509   
|
:0040DC0B 55                      push ebp
:0040DC0C 8BEC                    mov ebp, esp

* Possible StringData Ref from Data Obj ->"qoole.reg"
                                  |
:0040DC0E 68A8514B00              push 004B51A8
:0040DC13 E838D70800              call 0049B350
:0040DC18 83C404                  add esp, 00000004

* Possible StringData Ref from Data Obj ->"Bad registration key file!"
---------------------------End of partial code-------------------------------

Hmmmmm, how can I exit a procedure in assembler.......oh u can't be serious..
....with a 'ret' instruction???!! :pp Okay, let's change the code in such
way it just exits the procedure :-)) As u should now, the hex code for 'ret'
is C3. The best instruction to change is the push ebp (55).
Open you hex editor, goto that push ebp, and change the 55 into C3. Save it
and run GlideQoole. Register and enjoy.......u've cracked Qoole 2.50! ;-)

3. Summary
~~~~~~~~~~

-Change the four jump instructions before the "Invalid registration code"
into their opposits
-Change the push ebp instruction (55) into the ret instruction (C3) before
the "Bad registration key file!"


4. Outtro
~~~~~~~~~

Yup, I know there's also WinQoole, but that's exactly the same 'protection'
as GlideQoole, it's up to u cracking it :-)
If u have any questions, comments, etc... mail me on BlackBir@mail.dma.be
U can also visit my homepage at http://myplace.to.be/blackb. It's an anti-
virus site....no cracking stuff.

Thanks goto: +ORC, tKC, Qapla and all other fantastic tutorial writers who
teached me cracking! :-)

*****************************************************************************
*Qoole 2.50 is a great program. The author deserves the money he asks!!!    *
*****************************************************************************

BlackB
様様様様様様郵