Posted: Sat Dec 24, 2005 9:33 pm Post subject: Exe Guarder
Here is one very funny protector:
Exe Guarder is program for protecting executable files with password. The idea of this kind of programs is to protect file from unauthorized persons like your kids, colleges on work and even skilled crackers. Protected exe is usually encrypted with some strong crypto algorithm which uses your password for encryption. In that case it is impossible to decrypt original file without correct password. Only possible way is to try to catch some weakness in algorithm and try to make some brute force approach to generate password. That is very hard job and only very skilled reversers can do it.
But our Exe Guarder, although it claims to "...protect your exe-file with high strength encryption.", actually doesn't encrypt anything! It just adds piece of code that asks password and if pass is correct, it will execute exe. Neither one byte of main exe is encrypted what you can see if you open file with Olly and take a look at code section:
So basically, unwrapping Exe Guarder is just like cracking beginners crackme! We just need to find where OEP is and set that information in PE header!
Let's see that on one example. I protected "CRACKME 3.EXE" with some password. I just load it in Olly and placed bp on GetDlgItemTextA. I start exe, dialog box is showed and asks for pass. Just clicked OK without entering nothing, returned from user32.dll to main exe:
On above snippet everything is clear. First jump must not be executed but second one must be. NOP-ing first one and JMP-ing second one will solve problem. Now we just need to find where is OEP jump and that is easy:
00407A51 -FFE0 JMP EAX ; CRACKME3.00401000
And that's it! I just opened file with LordPE and change OEP to 1000. There is no need for dumping or import repairing.
Finally, what to say about this protection? Disaster!
The most lousy-coded software. The main application is lousy coded as well.
First, search in memory "Sorry, your registration code is wrong".
Set a memory breakpoint on access. Olly breaks when we hit the button "Verify", but the checking is already done, so we need to trace-back.
You do that yourself, I will give you the address I got from tracing back.
The algo for registration checkup is the call at 00405F56. Enter that call, you will see 2 strings. The first string works for *ANY* mail, and is limited to 20 days. The second string is not limited, and it works for *ANY* mail too.
I won't post the strings in here due to illegal content.
After we post any of the string in the editbox, it says "Successfully registered". Just re-start the application and - tada.
You think I had fun while reversing this one? hehe
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You can attach files in this forum You can download files in this forum