10

I like security as a hobby and I not so often I read and play with a few simple KeyGen games and I enjoy it.

Reversing and KeyGen is very interesting but I'm a beginner and my questions are probably very dumb but I will be very thankful if you could help me.

Until the moment I have reversed simple keygen applications using techniques such as:

  • Look for string text reference to find the interesting code area.
  • Keygen fishing.
  • And bypass IsDebuggerPresent check.

Yeah, I know, really basic stuff. Here is a video similar to what I do in general:

Just for learning sometimes I try to reverse a few small and medium application that I buy for Windows and looks like simple products without many protections.

This is a software that I acquired 2 months ago and the whole installation is around 50MB. One of the motivations to try apply my basic knowledge here is because I like to see if what I learned in keygens really work in real-life, my experience that medium softwares are much harder since keygens are very small and easy to find the routines that you want. :)

** Just to make it very clear, I have a license for this program and my intention is only learn and increase my knowledge. Since I have no commercial intention in break it or create any damage I will not disclosure the application - I hope you understand. **

OK, let's go. The application consist of one main executable (~33MB), 6 DLLs (very small ones and some of them are libeay32.dll, etc) and around 90 .xsd files (XML format). My first step was try to identify the programming language used and if a packer was present, please, see screen shots below:

enter image description here

enter image description here

It really appears to be developed in Delphi, with CFF I confirmed it. Also, there is no section that points for an packer looking at CFF information and EXE Information and RDG also say it's clean. However, RDG found IsDebuggerPresent and pointed for an protection software as you may see. However, I'm not sure if it's a false-positive.

On my application the serial is entered in a field like that:

enter image description here

And once I enter a wrong serial number (30 chars long) I get a message like that:

enter image description here

I guess it's not a MessageBox, or at least it's very custom one. For this kind of messages should I keep breakpoints at MessageBoxA, etc? Or there is a different API?

Below is a screenshot once I attach to the application running:

enter image description here

When I press "run" at OllyDbg it's what I get:

enter image description here

Here is a list of SEH chain:

enter image description here

Here are the "Windows" available, including the one that I would like to disassemble, examine and put a breakpoint:

enter image description here

However it fails to debug, see below, please:

enter image description here

Is it some kind of protection? How to disable this part of code, put breakpoints, etc?

Looking at "Text String References" I'm able to see just partial messages and not the one displayed on my custom "MessageBox".

enter image description here

Also, There are many parts that looks like an message that will be completed on the fly, for example "A chave informata esta" which means "They key entered is" or "Chave incorrecta n" which means "Wrong key at".

[img]http://img5.imageshack.us/img5/3382/11ionlyseetextstringsre.png[/img]

Additionally, I noted that are parts of the application when some texts are not stored as a "TextString", instead I see "char by char" in sequence at OllyDbg creating a few strings (also not very useful to me).

If I define a breakpoint in any of these TextStrings it's what happen - an exception:

enter image description here

Is it a protection? Any idea how to bypass it?

From here the only thing that I'm able to do it pass control to the application and all is over. :(

Also, if I refuse to pass control to the application and I continue with F7/F8 I get something like that:

enter image description here

It ends with an instruction not recognized by OllyDbg. Any idea?

I also tried to set breakpoints in Names from user32.dll such as GetDlgItemTextA and GetDlgItemTextW since I believe they are the APIs used to read my entered serial number. The strange thing is that they are exported and not imported as demonstrated below. Is it normal?

enter image description here

Once I created the breakpoint and stated stepping into I got this exception again and I was forced to pass control to application and game over again. :(

enter image description here

I was thinking it could be some basic Anti-debugging protections, so I enabled "aadp4olly" and "Olly Advanced" with many options but it was unable to solve the issues, so, I'm not so sure anymore about what is issue is.

All help and answers are very appreciated, but please, keep in mind that I'm a beginner.

** UPDATED **

Hi All,

Thanks for your answer, but it doesn't solve the whole issue. Please, see details below.

First I updated my PEid database from this link:

https://code.google.com/p/reverse-engineering-scripts/downloads/detail?name=UserDB.TXT

The following screenshot demonstrates PE details:

http://img444.imageshack.us/img444/8295/16pedetails.png

Here are details about PE sections:

Looks a bit strange for a not packed binary, right? But I can't figure out the correct packer.

http://img5.imageshack.us/img5/5764/17pesections.png

Entropy and and Fast Check say "not packed", but EP check points as packed:

http://img571.imageshack.us/img571/6251/18epappearstobepacked.png

Here is the original EP found:

http://img12.imageshack.us/img12/990/19originalep.png

RDG Packer Detector pointed that Obsidium protection was present, however I guess it's a false positive. See the unpacker failing to recognize the format:

The unpacker is available here: http://down.52pojie.cn/Tools/Unpackers/

http://img29.imageshack.us/img29/7/20obsidiumunpackingfail.png

Also, the great Ferrit Anti-Anti-Debuggin script for OllyDB was not enough to allow me to debug it. Please, see below:

http://img836.imageshack.us/img836/4352/21ferritantiantidebugis.png

http://img42.imageshack.us/img42/8721/22ferritantiantidebugis.png

From here I'm forced to pass control to application and I lost control of if as demonstrated on my first post. I tried to freeze all threads and just keep the main thread running but it continues to fail.

Resource Hacker is unable to read Delphi resources:

http://img812.imageshack.us/img812/9861/23resourcehackerfailsto.png

Even Resource Hacker FX fails because it says a new version Delphi was used to compile.

http://img560.imageshack.us/img560/7538/24resourcehackerfxfails.png

Delphi Decompiler also failed. First I tried attach to my target:

http://img11.imageshack.us/img11/89/25dedeattachingtotarget.png

Once the analysis finished it found the Classes Info:

http://img600.imageshack.us/img600/5935/26dedeloadedtarget.png

But the important thing are the "Forms" and "Procedures" and nothing was found:

http://img600.imageshack.us/img600/986/27dedeisunabletofindany.png

IDR (Interactive Delphi Reconstructor) also appears to be useless since the target application was compiled with Delphi 2011 or 2012 and no definition file is available for this version.

Ideas? Suggestions?

Thanks again for your help and effort.

** UPDATE **

Improve this question
8
  • Delphi implements its own "message box" as MessageDlg, this is likely what you're seeing.
    – 0xC0000022L ♦
    May 4, 2013 at 4:34
  • This a good first question. Hopefully someone will have a more specific answer but until then have you looked at the Lena tutorials on tuts4you? They start basic but get to defeating code protection quickly.
    – amccormack
    May 4, 2013 at 4:47
  • @amccormack: I was tempted to vote to close, but then decided to edit it. It was in a truly sorry state as you can still see in the revision history.
    – 0xC0000022L ♦
    May 4, 2013 at 5:05
  • Could you reduce the number of images ? Just link to the non-essential ones. Its taking a lot of time to load.
    – asheeshr
    May 4, 2013 at 7:27
  • 3
    It is really hard to tell what is your specific goal with this question, you should sum your questions at the end of the post and delete some pictures.
    – Hanan
    May 8, 2013 at 20:11

3 Answers 3

Reset to default
5

Have a look at R4ndom's Tutorial #17 on working with Delphi binaries and cracking them: http://thelegendofrandom.com/blog/archives/1472

He describes how you can use Resource Hacker (I prefer XN Resource Editor) to find the event handler for the form that calls the dialog you are looking for.

With knowledge of the form you are interested in, download DeDe and load the application into it. After DeDe completes its analysis, click on the "Forms" tab and you will see all event handlers associated with that form (OnClick is likely what you are looking for here). With the name of the event handler, click on "Procedures" and find the event and you will see its address.

enter image description here

From there, load your application in OllyDbg and set a breakpoint on the address of the event handler that you are interested in. This should put you near where the registration dialog is prompting you. The R4ndom tutorial can describe any necessary next steps from there.

Improve this answer
1
  • Hi Mick Grove, thanks for your answer. It's a bit more complicated. Please, check my UPDATE on the original post. Again, thanks for all your help and effort. Best regards.
    – Araujo
    May 9, 2013 at 23:54
1

I'm not sure it's true in your case, but a common anti-keygenning/debugging trick is to compress the parts of code you're going to want to breakpoint and over-write them at runtime. This way if an int3 is patched in at initial load, a reload will re-initialize the text section and remove your breakpoint.

It has more intense applications, but this would be a simple one.

Improve this answer
5
  • The work around for this, of course, is to use a hardware breakpoint.
    – amccormack
    May 6, 2013 at 19:32
  • 1
    not if aslr or some other randomizing tech is in place
    – RobotHumans
    May 6, 2013 at 23:26
  • Good point. I didn't think of that.
    – amccormack
    May 9, 2013 at 4:48
  • Hi guys, thanks for answer. So what is the solution for this case? Based on my updated original post do you think it may applies to my target? Thanks.
    – Araujo
    May 9, 2013 at 23:57
  • You could probably update with a linky to the keygenme to get a better response. If I overlooked it then say so...
    – RobotHumans
    May 10, 2013 at 0:09
1

You can use IDR (Interactive Delphi Reconstractor) in order to asssists you in the delphi code RE process.

It is a great tool.

Improve this answer
4
  • 2
    Please justify why is it a great tool. The answers are written not just for the OP but for all the other people who may come across this in the future. Thus a justification, will make it useful for everybody else as well.
    – asheeshr
    May 9, 2013 at 1:59
  • Hi Hanan N., I tried, but it's useless in my case since it's compiled with Delphi 2011 or 2012. Please, check my updated post. Thanks so much. Best regards.
    – Araujo
    May 9, 2013 at 23:58
  • IDR supports Delphi 2011 and 2012 since 29.12.2012
    – user1974
    May 11, 2013 at 17:09
  • @crypto As IDR has already been mentioned in this answer, it would be better to simply comment it edit that information into this instead of writing another redundant answer. As you do not yet have the reputation yet to do either, I would suggest looking around and seeing if there is anything you can answer, or maybe asking a few questions. You can both edit and comment after you get 50 rep.
    – asheeshr
    May 12, 2013 at 2:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.