I am starting with reverse engineering/cracking with advanced knowledge about programming and functioning of the operating system and I saw a whole series of lena151 Lenas Reversing for Newbies but I have a problem I do not know how I should properly begin cracking windowed crackmes without using call stack and finding text strings. For example I have ollydbg and Pulsar Crackme (Level 0) (https://uloz.to/!CsZzoI6kT9zF/crackme-exe) I have already cracked, and several other, (key is PuL-sAr-001) but I crack him only because I accidentally found badboy/goodboy but it can not crack it using another method (in more complicated crackmes it is big problem). Is there any tutorial where this is explained ? And what method you use which may also be used in the analysis viruses ?
There are many ways to go about changing the behavior of programs. For example, if you have a program that checks for the date and time in order to decide if the product is expired, you could: a. change the system date and time to temporarily "crack" the program or b. patch the system call that checks for the date and time to return an acceptable value.
You could also patch the kernel (which is probably unsuitable for a check like this, as it will affect the whole system) or simply find the check in the executable and change the code to jump it , or just remove it...
What you're doing is trying to reverse engineer an application and change it to do what you want. This requires knowledge in general and specific areas, dependening on what kind of program you're trying to reverse engineer.
Here's a few a practical leads on how you could achieve what you're trying to do:
- Use a tool like Regshot to compare changes in the registry
- Use a tool like Program monitor from SystemInternals to find out what the program is doing
- Place breakpoints on all suspect system calls
- With complex applications, once you find a starting point you may need to reverse engineer the assembly code to understand what it's doing
- You can use Radare2/ IDA to statically analyze (or actively debug) the program and rename methods until you reach an understanding of what must be done to achieve your goal.
If you're interested in learning how to reverse engineer applications there are many books on this subject that you can look for and read.
Here's a list of (some of the) things you'd need to know:
- Understand the OS you're working in
- Knowledge of (several) programming languages
- Understand the PE/ELF file formats (or any other format you'd want to reverse engineer)
- Understanding Assembly language
Needless to say, reverse engineering may be illegal in your location, or on specific products (see EULA), so make sure that you're not doing anything that you are not allowed to do.
Hope this helps