School project - Cracking a school emulator

Question

John here. I'm in the last half of our IT school, and we got a side project from one of our teachers. He wrote a emulator back in 2009 in delphi, which is in use till that time. Nothing special, just a serial bus emulator, what we can controll over an interface, or simulate processes via C++ code w/ his dll. A fun little application. I wanted to obtain a copy for myself, and I've emailed the required stuff to myself. The surprise came then. If I try to run the program outside of the school environment, it simply just throws me out with an error message, states that I don't have permission to run that software, then it exits. Hm. The next day, we had lessons with that teacher, and I've asked about the program. He was glad that "finally somebody tried that." He told me, that I'm free to test the program till it's limits, and If I manage to run it on my laptop, he could reward me with some good grades. Next, he told some informations about the program for the whole class: - We're talking about a 64bit process. It does not check for the DLL, but it checks for "something", and if that something is found, then the program will start. If not, a simple error message will be shown, then the process terminates. Also, the program only check for once, not anymore till the program has stopped.

So, I've got home with my new informations collected, then fired up x64dbg and IDA to see what's going on. I was able to find only the messageBox(W) generation. Before that it check's for a "test al,al". if it's equal, it jumps to a adress, but it only returns a "nop", and the messagebox pops.

I've tried to search for string references, like some hard coded file location, or registry entries, also the messagebox's text, but with no luck. Nothing found yet.

So at the moment, here I am. How should I move forward about patching the check, If I don't even know what am I searching for at the first place? Of course, they do not teach reverse engineering at school, but we're free to do anything at our free time, and if it gives some results, it's rewarded.

Any ideas?

Thanks, John.

Answer 1

As the application is written in Delphi I would recommend to run the binary through IDR (Interactive Delphi Recorder). This tools has a better understanding of Delphi and VCL internals and can then produce and .idc file that you can load into Ida Pro. You'll have (mostly) correct function and symbol naming which makes reading the code much easier. Then execute up to to the messagebox and check the call stack to see where you came from. Possibly check might be IP adress, domain name, computername (does it follow some naming convention) etc.