WinTar-Remote tut!                                                  24/08/97
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Program: WinTar-Remote
Version: 2.2.1
URL:http://www.spiralcomm.com 
Description: i know shit about this program i picked up cause of the 
             size
Operating System: Windows
Cracker: nIabI [Me'97]
Level: Intermediate
Tools: SoftICE, W32Dasm, a Hex Editor.   
Protection Type: 30 day trial
Encrypted/DLL: No
Method: Dissasemble

0.-index:

0.-index
1.-Intro
2.-What We need (tools)
3.-Let's Crack the splash screen
4.- Lic. screen removal
5.- The 1s part of the time trial
6.- The 2nd part of the time trial
7.-Last Notes
8.-Notes
9.-Thak you's



1.- Intro:

Hello, ok here again on another tut for C4N, this time i am goin to talk about Time Trials
Even tough they are easy a lot of ppl still don't get it so this is why this tut is gone 
(hopefully) teach you, also i will teach some of nag remove and bmp (splash) screens :-) 

ok, the program had to be a time trial (of course) but we need it a not to big program but one 
that had some potencial in it or i could have used Rhino 3d wich is not small and does not 
have any teaching potential (u changed one byte and it's cracked) so ok with the help of a
friend Griml0ck we decited to get this program is called WinTAR-Remote by SpiralCom 
Communications Inc. what this program does is not important to us we wil crack it and 
delted it for educational purpose ONLY :-).

In this tut i will asume u know how to use all of the tools i will use here else please get other
tuts that do explain how to use them (TKC's, Edison's, josephCo's and others)


2.- What We need (tools):

W32dasm (used mostly)
SoftIce
Any Hexeditor
a patch maker (if we want to release our crack), i recomen Gpatch by jes and patchit by Qapla
gpatch i like better cause of ease of use and does some good patches on the other hand patchit
gives u the source of the patch in C :-), other wiseuse Pascal or C and do ur own patch (not
explained in this tut sorry).


3.- Let's Crack the splash screen:

ok once d/l the program u run it add se a nasty splash that says Thanks for trying WinTar blah
blah,blah after some secs it shows u a license aggrement (ewww), now we don't like those 2 things
so let's start by taking them away we enter softice and set a bpx on LoadBitmapA once we do this 
we run the program again and boom u in Softice cause of one of the bpx u seted b4 now we can see 
this (from the w32dasm dissaemble) :

* Reference To: USER32.SetTimer, Ord:01FEh   ; set time the splash screen is goin to show
                                  |
:0040F5F4 FF15F0C64200            Call dword ptr [0042C6F0]
:0040F5FA E92D010000              jmp 0040F72C

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F6FF(C)
|
:0040F5FF 6A67                    push 00000067    ; hmm nice push here (does nothing good)        
:0040F601 A124A54200              mov eax, dword ptr [0042A524]
:0040F606 50                      push eax

* Reference To: USER32.LoadBitmapA, Ord:0165h      ; this is where u land
                                  |
:0040F607 FF15D0C64200            Call dword ptr [0042C6D0]
:0040F60D 8945DC                  mov dword ptr [ebp-24], eax
:0040F610 8D859CFEFFFF            lea eax, dword ptr [ebp+FFFFFE9C]
:0040F616 50                      push eax
:0040F617 8B4508                  mov eax, dword ptr [ebp+08]
:0040F61A 50                      push eax

* Reference To: USER32.BeginPaint, Ord:0009h  ; begin the painting of the splash
                                  |
:0040F61B FF1574C64200            Call dword ptr [0042C674] 
:0040F621 8945F8                  mov dword ptr [ebp-08], eax
:0040F624 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F627 50                      push eax

* Reference To: GDI32.CreateCompatibleDC, Ord:001Fh
                                  |
:0040F628 FF1590C44200            Call dword ptr [0042C490]
:0040F62E 8945FC                  mov dword ptr [ebp-04], eax
:0040F631 8B45DC                  mov eax, dword ptr [ebp-24]
:0040F634 50                      push eax
:0040F635 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F638 50                      push eax

* Reference To: GDI32.SelectObject, Ord:013Ch
                                  |
:0040F639 FF15B0C44200            Call dword ptr [0042C4B0]
:0040F63F 8D45E0                  lea eax, dword ptr [ebp-20]
:0040F642 50                      push eax
:0040F643 6A18                    push 00000018
:0040F645 8B45DC                  mov eax, dword ptr [ebp-24]
:0040F648 50                      push eax

* Reference To: GDI32.GetObjectA, Ord:00DEh
                                  |
:0040F649 FF1598C44200            Call dword ptr [0042C498]
:0040F64F 682000CC00              push 00CC0020
:0040F654 6A00                    push 00000000
:0040F656 6A00                    push 00000000
:0040F658 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F65B 50                      push eax
:0040F65C 8B45E8                  mov eax, dword ptr [ebp-18]
:0040F65F 50                      push eax
:0040F660 8B45E4                  mov eax, dword ptr [ebp-1C]
:0040F663 50                      push eax
:0040F664 6A00                    push 00000000
:0040F666 6A00                    push 00000000
:0040F668 8B45F8                  mov eax, dword ptr [ebp-08]
:0040F66B 50                      push eax

* Reference To: GDI32.BitBlt, Ord:000Ah
                                  |
:0040F66C FF1588C44200            Call dword ptr [0042C488]
:0040F672 8B45FC                  mov eax, dword ptr [ebp-04]
:0040F675 50                      push eax

* Reference To: GDI32.DeleteDC, Ord:0043h
                                  |
:0040F676 FF1584C44200            Call dword ptr [0042C484]
:0040F67C 8B45DC                  mov eax, dword ptr [ebp-24]
:0040F67F 50                      push eax

* Reference To: GDI32.DeleteObject, Ord:0046h
                                  |
:0040F680 FF158CC44200            Call dword ptr [0042C48C]
:0040F686 8D859CFEFFFF            lea eax, dword ptr [ebp+FFFFFE9C]
:0040F68C 50                      push eax
:0040F68D 8B4508                  mov eax, dword ptr [ebp+08]
:0040F690 50                      push eax

* Reference To: USER32.EndPaint, Ord:00AFh
                                  |
:0040F691 FF1570C64200            Call dword ptr [0042C670]
:0040F697 B801000000              mov eax, 00000001
:0040F69C E992000000              jmp 0040F733

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040F721(C)
|
:0040F6A1 8B4510                  mov eax, dword ptr [ebp+10]
:0040F6A4 50                      push eax
:0040F6A5 8B4508                  mov eax, dword ptr [ebp+08]
:0040F6A8 50                      push eax

* Reference To: USER32.KillTimer, Ord:0162h ; kiil the timer set b4 to show the splash 
                                  |
:0040F6A9 FF15F4C64200            Call dword ptr [0042C6F4]


ok u can see here one thing the line that contains push 00000067 in 40f5ff does nothing
so to crack the splash screen we chage this

:0040F5FF 6A67                    push 00000067    ; hmm nice push here (does nothing good)
to this
:0040F5FF E9A5000000              JMP  0040F6A9    ; Nice jump, kills the timer and the splash

so here the splash screen is disabled and we can continue cracking.

4.- Lic. screen removal:

ok this par needs some zen cracking :-) this is part of the disssemble in w32dasm :


:004094DD 813D3C5A420000010000    cmp dword ptr [00425A3C], 00000100
:004094E7 0F8533000000            jne 00409520
:004094ED 8B4508                  mov eax, dword ptr [ebp+08]
:004094F0 50                      push eax
:004094F1 E80AEFFFFF              call 00408400    ; call the lic screen(how did i got here ?
                                                   ; like i said zen cracking :-)
:004094F6 83C404                  add esp, 00000004
:004094F9 85C0                    test eax, eax
:004094FB 0F851F000000            jne 00409520
:00409501 C705105C420001000000    mov dword ptr [00425C10], 00000001
:0040950B 6A00                    push 00000000
:0040950D 6A00                    push 00000000
:0040950F 6A10                    push 00000010
:00409511 8B4508                  mov eax, dword ptr [ebp+08]
:00409514 50                      push eax

this is what the call to the lic screen is :

* Referenced by a CALL at Address:
|:004094F1   
|
:00408400 55                      push ebp      ; this code is only checking if the file is not
                                                ; delted or something like that 
:00408401 8BEC                    mov ebp, esp
:00408403 83EC08                  sub esp, 00000008
:00408406 53                      push ebx
:00408407 56                      push esi
:00408408 57                      push edi
:00408409 C745F867844000          mov [ebp-08], 00408467
:00408410 6A00                    push 00000000
:00408412 8B45F8                  mov eax, dword ptr [ebp-08]
:00408415 50                      push eax
:00408416 8B4508                  mov eax, dword ptr [ebp+08]
:00408419 50                      push eax
:0040841A 6A66                    push 00000066
:0040841C A124A54200              mov eax, dword ptr [0042A524]
:00408421 50                      push eax

* Reference To: USER32.DialogBoxParamA, Ord:008Ah
                                  |
:00408422 FF15C8C64200            Call dword ptr [0042C6C8]
:00408428 8945FC                  mov dword ptr [ebp-04], eax
:0040842B 837DFC02                cmp dword ptr [ebp-04], 00000002
:0040842F 0F8512000000            jne 00408447

* Possible Reference to String Resource ID=03302: "The licence agreement file is missing or 
                                                   corrupted.  Please "
                                                   ; as u can see here if u delete the 
                                                   ; licence.txt u get this msg  

ok what we can do here is this since none of the checking of calling is done AFTER the call
once it finds a ret the program says ok this guy pushed the i agree button, continue, so what we
can do here is give the program a ret, whe change this : 

:00408400 55                      push ebp
to this
:00408400 C3                      ret
 the program calls the screen but a ret(return from call) is there so it returns to the program.


5.- The 1s part of the time trial:

ok now once we dissabled all of the nag's and nasty stuff we need to take the 30 day trial 
we try and find something on the nag box in w32dasm what we find is just a lot of garbage in this
nag (not gabage but dificult to follow) how about something else ? hmm the .ini ? ok let's try 
we search for it and land here :

* Possible StringData Ref from Data Obj ->"wintar.ini"
                                  |
:00409275 A1485A4200              mov eax, dword ptr [00425A48]
:0040927A 50                      push eax
:0040927B 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"Validate"
                                  |
:0040927D 68405C4200              push 00425C40

* Possible StringData Ref from Data Obj ->"UserOpt"
                                  |
:00409282 684C5C4200              push 00425C4C

* Reference To: KERNEL32.GetPrivateProfileIntA, Ord:00F9h
                                  |
:00409287 FF152CC54200            Call dword ptr [0042C52C]
:0040928D 8985F4FEFFFF            mov dword ptr [ebp+FFFFFEF4], eax
:00409293 E91A000000              jmp 004092B2

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:0040926F(C)
|
:00409298 6A00                    push 00000000

* Possible StringData Ref from Data Obj ->"Validate"
                                  |
:0040929A 68545C4200              push 00425C54

* Possible StringData Ref from Data Obj ->"UserOpt"
                                  |
:0040929F 68605C4200              push 00425C60
:004092A4 E896E2FFFF              call 0040753F                 ; if you follow in SI here u will
                                                                ; find that this call does 
                                                                ; does something strange so we 
                                                                ; go to the call  
:004092A9 83C40C                  add esp, 0000000C
:004092AC 8985F4FEFFFF            mov dword ptr [ebp+FFFFFEF4], eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00409293(U)
|
:004092B2 83BDF4FEFFFF00          cmp dword ptr [ebp+FFFFFEF4], 00000000
:004092B9 0F850D000000            jne 004092CC
:004092BF E89CE8FFFF              call 00407B60                ; take a deep look :-)
:004092C4 85C0                    test eax, eax
:004092C6 0F849B000000            je 00409367

this is what we get by the call at 4092A4 

* Referenced by a CALL at Addresses:
|:004092A4   , :00410C4F   , :00410C7F   , :00410C98   , :00410CB1  
|:00410CCA   , :00410CE3   , :00410CFC   , :00410D15   , :00410D2E    
|:00410D47   , :00410D60   , :00410D80   , :00410D99   , :00410DB2   
|:00410DCB   , :00410DE4   , :00410DFD   , :00410E16   , :00411304   
|:0041131D   , :00416C74   , :00416C8F   , :00416CAA   , :00416F4F   
|:00416F6A   , :00416F85   , :00417415   , :00417622   , :004177C1   
|:004177E2   , :0041788D   , :00417961   , :00417982   , :004179A3   
|                                                                
                                                   ; WOW this part sure does get called !
:0040753F 55                      push ebp
:00407540 8BEC                    mov ebp, esp
:00407542 81EC14010000            sub esp, 00000114
:00407548 53                      push ebx
:00407549 56                      push esi
:0040754A 57                      push edi
:0040754B C745F404010000          mov [ebp-0C], 00000104
:00407552 833D3856420000          cmp dword ptr [00425638], 00000000 ; is the flag Zero ?
:00407559 0F8507000000            jne 00407566                       ; no then bug off
:0040755F 33C0                    xor eax, eax
:00407561 E9A0000000              jmp 00407606     

what we can do here is simple we look at our Registers ans check is EAX is zero b4 it called this
part........ we check and see that it is zero so this is getting better :) what we do here is 
simple ok remeber the lic. removal part how the call only wanted a ret ? ok so this is equal 
change this: 

:0040753F 55                      push ebp
to this
:0040753F C3                      RET
there now the MARKER (if you set the time ahead or b4 30 days) is removed.


6.- The 2nd part of the time trial:

ok now we need to remove the 30 day check this will ALSO require more zen (this is prolly a zen
tut and not a time trial :] ) but not many zen if u are a good looker u can see this call after
the check mark call :

:004092BF E89CE8FFFF              call 00407B60 ; this is our check our time call :-)

unlucky us u can't do the RET trick here :-( so we go deep inside the call and find this:


* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407CA1(C)
|
:00407CB1 833DB457420000          cmp dword ptr [004257B4], 00000000 ; check the flag to zero
:00407CB8 0F850A000000            jne 00407CC8                       ; no? the bug off 
:00407CBE B801000000              mov eax, 00000001                  ; and move EAX to 1
                                                                     ; wich 1 = bad time
:00407CC3 E902000000              jmp 00407CCA                       ; jump to return

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407CB8(C)
|
:00407CC8 33C0                    xor eax, eax

* Referenced by a (U)nconditional or (C)onditional Jump at Address:
|:00407CC3(U)
|
:00407CCA E900000000              jmp 00407CCF

* Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
|:00407BA4(U), :00407BBA(U), :00407BE6(U), :00407C1A(U), :00407C65(U)
|:00407CCA(U)
|
:00407CCF 5F                      pop edi
:00407CD0 5E                      pop esi
:00407CD1 5B                      pop ebx
:00407CD2 C9                      leave
:00407CD3 C3                      ret

ok now here the program is looking for something, what could it be ?..........
ok if we continue with eax in 1 we get the sorry screen and a help file opens and our program
terminates, we don't like this so we go back here and check again, ok i got it it checks if eax
is ZERO if it is then the guy is still on the 30 day limit, so we change this :

:00407CBE B801000000              mov eax, 00000001                  ; and move EAX to 1
to this
:00407CBE B800000000              mov eax, 00000000                  ; and move EAX to 0

now the program even if you are on the 30 day limit it will let you use it for the rest of your
life :-).

7.-Last Notes:
ok now to finally do our crack we enter a hexeditor and search for the opcodes and change them 
(like,i said at the beggining i assume you allready know this).


8.-Notes:

You could search for the text UNREGISTERED and changed to anything u like like CrackedVer.
ans search for the string Days left and change it to anything as well i will not explain this 
because i think AT least the programmers deserve that since u cracking the software :-).


9.-Thak you's:

Ok thaks go to the follwing persons:
JosephCo: keep up the good work d00d
mpbaer: ha Rebirth ROX !!!!!! :)))
Razzi: ur tuts rule !!!
^pain^: cause u cool :)
tHATDUDE: he isnpired me to become a cracker :-)
Fant0m : damm ur coding is good
GThorne: haha this guy rox the world ! 
Tgunner: 10x for everything
lgb: 10q as well for all the help and support :)
blorght: the only female i seen (err on irc) that can do a lot of stuff ! u rule babe :-)
Griml0ck: he inspired me and asked me to this tut :-) ok d00d for you here it goes.
TeRaphY: this guy is kewl as well :) 
Krazy_N: he is not crazy but he is kewl :) 
all the regulars of #cracking4newbies thanks that shows us that we growing ! :-) 
#cracking all of the guys in it aswell retf in especial :-P
#revolt bring up the warez ! :) 
cat|man: thanks for those sites :) 
if i forgot anyone please let me know i will respond ahh ok 10q :)
oh and also all of the ppl that shows some cracking teaching or explaining !!

                                                   nIabI[ME'97]
 

