2

So I'm learning Reverse Engineering / Software cracking. I have a program that I am practicing on that requires a dongle in order for the program to start.

From looking through the disassembly of the program I figured out that at some point of the execution the program is calling winscard.dll When the dongle is inserted, in Windows it comes up as a smart card reader.

When there is no dongle inserted, the software gives you a MessageBox stating The dongle not found. I've found this execution point in user32.dll, but I can't figure out at which point does the main software call this.

I'd like to be able to figure out at what point does the software call winscard.dll and what it's looking for as a return. I've tried to figure this out with Ollydbg and also IDA Pro.

Any help for someone trying to learn would be great.

Thanks

  • Why don't you set a break point on all MessageBox calls, run the program without the dongle (to trigger the break point) then look at the stack trace to see what functions were called leading up to the current function call. – Jacob Persi Mar 10 '17 at 13:52
  • That's the thing, I don't know how to proceed.. In ollydbg I select breakpoint--> and put a check on MessageboxW because in IDA I can find it in import, but ollydbg never stops on them.. I look at trace and I have no idea what function is calling MessageBox pastebin.com/FLu1JjQz – SoupyLoops Mar 10 '17 at 18:44
1

First please not that the dongle may be used for cryptographic purposes, so there might be no point in trying to skip the check.

Second, winscard.dll can not be called. Try to set a breakpoint on common methods like SCardEstablishContext and SCardListReaders to find the right check.

For example, if no SmartCard is connected to the system at all, SCardListReaders will return 0x8010002E (SCARD_E_NO_READERS_AVAILABLE).

I'm assuming the second check would involve the mszReaders parameter of the function to check if the right reader is connected.

If you knew the location of the 'success'-path (i.e. the address which is executed when everything is fine) you could try to jump there from these locations, else you will have to go though the next branches as well.

Good luck.

  • Thanks for answering. I don't think it's used for encryption, only to verify the presence of a dongle. If I start the program and remove the dongle, it still works. I will check for those methods. – SoupyLoops Mar 10 '17 at 21:42
  • I figured out how to set a breakpoint everytime winscard.dll is located. It seems to be checking this over and over in ntdll.dll pastebin.com/pZD3jiXj – SoupyLoops Mar 10 '17 at 22:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.