				_CbD_ Tutorial #3
			Function Disabled Protections Defeated
				Date  7-28-97
			Target: WinScan version 2.0.06

About the Protection:
	Function Disabled Protections are very comman now days and are one of 
	the most popular among high priced software or specialty software. But 
	there days of stoping us are over........ Now !!!!!!

Target:
	WinScan ver 2.0.06
	WinScan is an intelligent scan, trace and vector editing program designed for use with TWAIN compliant 	scanners and popular vector illustration packages such as CorelDRAW. This is a very handy program
	if you are in the graphics industry or if you make vinyl signs with plotters (As i Do)...

Where to get it :
	http://www.airmark.com/

Tools Needed:
	SoftIce (SI) (Required)
	W32dasm ( optional)
	Hiew Hexeditor (included with Tutorial) (Required)
	Borland Resource Work Shop (optional)

Pre Crack Notes:
	Ok there are several different steps in this crack and there are really 3 cracks that will be done
	each one of them will have several steps each. If you dont have the optional Tools above
	you will only be able do complete the first 2 parts of this tutorial. (The important ones)
	the Last section of the crack only  removes the DEMO messages at start and in the about box.
	it will change them to the registered Messages instead.. ( Big Deal i know)...

The Crack..........
	Ok you should have gotten the programs you need by now so lets start the crack.
	
Step #1 :
	Fire up your program (WinScan) and have a look at it, You should see the Big ugly blue box that
	says this is a DEMO version of the program (Like we didnt know this) it is not that big of a deal
	because it goes away if you click on it . But now open one of the sample .bmp files that 
	are in the WinScan Dir. Now try to save the file, you will get a box that says 
	" This Command is not Allowed Blah Blah Blah" ok so it dont want us to save, But we want to
	I mean shit how can you evalutate software if you cant save the work to see its quality?
	well I dont think you can so we will cure this problem :-).
	Just remember that this little message came to us in the form of a message box.

Step #2:
	Now we have a good idea that we are getting the nag from a message box so 
	if we can break at the message we can see what calls it right. or we could use 	
	W32dasm and located the point that the message is called. well that would take
	a bit longer to trace out the code that calls it so we will save that for later or for those
	that want to learn a bit more about finding this type of protection calls.
	so for now we are just gonna use SI (as it is all that is really needed) to break on the 
	message that we get when we try to save. So lets start....
	First press Ctrl-D to get in SI(Softice) and lets see what we have here, Lets see if we
	have any breakpoints left over from a project that you was working on before you 
	started this one so do this    BL   This will give you a listing of all breakpoints you 
	have set in SI. Well we dont want those to cause us problems in this crack so we
	will do one of 2 things (1) Clear them with BC *  (2) disable them with  BD *   if you 
	dont need the BP's (BreakPoints) you can clear them, if you will need them for
	another project then just disable them for now. Ok now that we have that out of the
	way( Bare in Mind i write my tut's so anyone can follow them even if they have
	never cracked before) Lets set our BreakPoints that we will need for this crack
	so lets Do this BPX MESSAGEBOXA   <--- This will make SI break when the 
	call to the Messagebox is made. For now that is the only one we need so lets
	Ctrl-D back to our target WinScan.
Step #3:
	Ok now lets set all this in motion, So try to save this file with the [SAVE] from the menu
	or the Disk Icon in the Toolbar. Boom to softice we go Now we are in SI at the
	point our program is ready to show us the nag. Now lets think about what we
	want to do here (1) we want to find out where this call came from (2) we want to 
	make it go to the real save Dlg Box and not this nag. So we will do a F11 so we
	can get back to what called this function. You will pop back into WinScan where
	you will see the Nag. Press Ok and you will pop back to SI Now we are not there yet
	cause if you look on the Line between the Command window and the Code window
	you will see MFC blah  blah blah well this is the place that our message box was called
	but this is not our program, Our program called this to get the box so what we will do is 
	press F10 (single Step) till we get back to our program so press F10 till you see
	WinScan on the line between the command and code windows. when you get there
	you should see somthing like the following

(note the addresses may not be the same on yours)

0137:00455AF5		CALL	0045D800           <----- This is what calls our little MessageBox
0137:00455AFA		JMP 	00455B1E 	<---- Ok we told him he cant save  so lets go back
0137:00455AFC		MOV	ECX, [EBP-14]     <---- not important.

ok now we found the call so lets scroll up a few lines and see what we can see. Should like like this

(note the addresses may not be the same on yours)
0137:00455AE0		MOV 	EAX,[EAX+4]                                             <--- set demo flag
0137:00455AE3		CMP	DWORD PTR  [EAX + 000000C4] ,00 <-- check and see if this is a demo ver
0137:00455AEA		JZ	00455B16                                                 <---- if  Zero then this is a Full ver else                                                                                                                                            this is a Demo
0137:00455AEC		PUSH	FF 	                                                    <--- save some info
0137:00455AEE		PUSH	10                                                               <--- save some more info 
0137:00455AF0		PUSH 	0000009D	                                    <--- yup save even more info
0137:00455AF5		CALL	0045D800                                                 <----- This is what calls our little                                                                                                                                              MessageBox
0137:00455AFA		JMP 	00455B1E                                                 <---- Ok we told him he cant save  so lets                                                                                                                                            
                                                                                                                                            go on working
0137:00455AFC		MOV	ECX, [EBP-14]                                           <---- not important.

	ok if you look real close i think you can see what we need to do now and if you cant i will
	tell you:
0137:00455AEA		JZ	00455B16     This jump here will send us to the real save dialog that we
						want .
	So we need to change the JZ to a JNZ so that the program will think that if we are a DEMO
	we should jump to the real Save Dialog and not the Nag. But before we do this lets get some info
	that we will need for part 2 of the crack  so Do a      D xxxx:00455AEA    (xxxx is the address you see)
	now look in your data window for something like this 

0137:00455AEA		74   2A   6A   FF   6A   10   68   9D - 00   00   00   E8   06   7D  00   00
			 ^     ^      ^      ^      ^       ^      ^     ^ 	 
	You will need all these number sets that have a ^ under them so right them down
	(Note if you do not have a Data window just above your code window type WD and press enter
	in the commad window and it should open up you should also have your Registers window
	open as well and to do this type WR and press enter in the command window)
	Well lets see if we are right do this  
	A xxxx:00455AEA  and press enter (note where the xxxx is put the right address you see on 
	your screen)
	now you should see somthing like this

A xxxx:00455AEA
xxxx:00455AEA       
	
	in your command window
	you need to type in this 
	
	JNZ 00455B16         

	then press enter and then press enter again to get back to the command line
	now lets see if this werks so press Ctrl-D and when you pop back to WinScan
	try to save again   WOW you can now save . Well the only thing is that you cant use the 
	Save As function so we need to fix that to and to do this we follow the same steps as above
	but instead of pressing the Save we press Save As from the Menu
	and you will break right back in the same Message that you did before
	you need only to follow then same steps as above to get back to the WinScan
	call and then scroll back up and find the JZ that will send us to where we want to go

	if you cant seem to make it werk here is the steps for this one

Step #1:
	Ok now lets set all this in motion, So try to save this file with the [SAVE AS] from the menu
	 Boom to softice we go Now we are back in SI at the same 
	point our program is ready to show us the nag. Now lets think about what we
	want to do here (1) we want to find out where this call came from (2) we want to 
	make it go to the real save Dlg Box and not this nag. So we will do a F11 so we
	can get back to what called this function. You will pop back into WinScan where
	you will see the Nag. Press Ok and you will pop back to SI Now we are not there yet
	cause if you look on the Line between the Command window and the Code window
	you will see MFC blah  blah blah well this is the place that our message box was called
	but this is not our program, Our program called this to get the box so what we will do is 
	press F10 (single Step) till we get back to our program so press F10 till you see
	WinScan on the line between the command and code windows. when you get there
	you should see somthing like the following

(note the addresses may not be the same on yours)

0137:00455BD5		CALL	0045D800           <----- This is what calls our little MessageBox
0137:00455BDA		JMP 	00455BFE 	<---- Ok we told him he cant save  so lets go back
0137:00455BDC	MOV	ECX, [EBP-14]     <---- not important.

ok now we found the call so lets scroll up a few lines and see what we can see. Should like like this

(note the addresses may not be the same on yours)
0137:00455BC0		MOV 	EAX,[EAX+4]                                             <--- set demo flag
0137:00455BC3		CMP	DWORD PTR  [EAX + 000000C4] ,00 <-- check and see if this is a demo ver
0137:00455BCA		JZ	00455BF6                                                <---- if  Zero then this is a Full ver else                                                                                                                                            									this is a Demo
0137:00455BCC	PUSH	FF 	                                                    <--- save some info
0137:00455BDE	PUSH	10                                                               <--- save some more info 
0137:00455BD0		PUSH 	0000009D	                                    <--- yup save even more info
0137:00455BD5		CALL	0045D800                                                 <----- This is what calls our little                                                                                                                                              MessageBox
0137:00455BDA		JMP 	00455BFE                                                 <---- Ok we told him he cant save  so lets                                                                                                                                            
                                                                                                                                            go on working
0137:00455BDC	MOV	ECX, [EBP-14]                                           <---- not important.

	ok if you look real close i think you can see what we need to do now and if you cant i will
	tell you:

0137:00455BCA		JZ	00455BF6    This jump here will send us to the real save dialog that we
						want .
	So we need to change the JZ to a JNZ so that the program will think that if we are a DEMO
	we should jump to the real Save Dialog and not the Nag. Well lets see if we are right
	do this  A xxxx:00455BCA  and press enter (note where the xxxx is put the right address you see on 
	your screen:
	now you should see somthing like this

A xxxx:00455BCA
xxxx:00455BCA       
	in your command window
	you need to type in this 
	
	JNZ 00455BF6         

	then press enter and then press enter again to get back to the command line
	now lets see if this werks so press Ctrl-D and when you pop back to WinScan
	try to SAVE AS again   WOW you can now Save As   now isnt this fun

	well the only thing is that this will only werk till we exit our program, When we restart it  the nags
	will be right back so now we need to make a real crack for our program.
	so on to part 2 of this Crack

Part 2: Hex Editing our program

	well lets make sure we have all the info we will need..
	Remeber the things i told you to write down  well i hope you did ;-)
	and if not then here it is 
xxxx:00455AEA		74   2A   6A   FF   6A   10   68   9D
	well we will need this in Hiew to search for our Jumps we need to change
	(by the way you should print this file to make lie easier on you)
	Lets make a backup copy of our file you can name it what ever you wish (i used
	WinScan.cbd) just dont use the .bak as this is needed else where
	So lets fire up Hiew to do this we will need to have the program and Hiew in the 
	same Directory I use a Temp dir and copy both files to it (Hiew and Winscan.cbd)
	 now at a dos prompt type     
 			(the numbers in ( ) are the steps)
	(1) Hiew WinScan.cbd (or what ever you named it) now you will be in the Hiew program and will see a 
	bunch of shit that makes no sence what so ever 
	(2) so press the F4 key to get the Hex View (or what ever the key is at the 	
	bottom) now we will have to search for our command and in order to do this we will
	need to have the numbers above 
	(3) so press F7 and then enter the numebrs above
	ie ( 74 2A 6A FF 6A 10 68 9D ) AND  and press enter 
	then you will land at the first match it found
	you 
	(4) should press F2 to get the ASM code of the above string
	(5) then press F3 to edit it 
	(6) You will get a box that will show you a    je   and a address you just need to change the 
	je    to   JNZ then press enter
	(7) now press F9 to update 
	(8) and Press F10 to quit
	now restart Hiew and do each step over again
	The first one is the Save function and if you do it again you will be in the Save As function
	And if you do it a third time you will be in the Save Vectors functioin(not talk about because you 
	must have a scanner to use it) but go ahead and crack it to ..	
	Well that is it after all that you will have a fully working program that will work forever
	Now if you wish to get rid of the DEMO screens that you see when you start the program
	and in the About Box you can continue to Part 3 of the Crack (Must have Borland Resource WorkShop)
	
Part 3 Removing the Demo Screens

	Start BRW and locate the Bitmaps that represent the Demo Messages
		239 <--- About Box BitMap
		240 <---- Start up BitMap
	Now lets find the ones for the Full version
		102 <--- Startup BitMap
		159 <--- About Box BitMap
	Now all you have to do is Delete 239 and 240
	then select 102 and then make a Duplicate of it (Right Click of the mouse and you will see Duplicate)
	then do the same for 159 after you have done this it will rename them to something like
	BitMap1  and BitMap 2   well rename the copy of 102 to 240 and the copy of 159 to 239 and that is
	it  you now will see the Full Version srceens when you run your program . Although this is not 
	Needed for the Crack to work this is just another thing you can do to remove the DEMO
	nags But seeing how if you like the Program you are going to Buy it (RIGHT) you reall need not
	do this part ;-)

Part 4  Yeah i Know i said 3 parts but read on
	Well if you wish to make a crack that you can distribute to others then you can get
	a program like gpatch or write your onw in your favorite language to do all of the 
	above changes .... Well that is it for this Tutorial
	
	I Hope that you have learned something from this tutorial and i hope i have helped you to
	better understand how this type of protection works. And remember this is a Shareware
	program and if you intend to use it  then Buy It after all they were nice enough to give us
	the demo so we could Crack and Evaluate it so cintribute to them and give them the money
	they ask for   it is only fair........... _CbD_ [ME/C4N'97] 

	I want to take a few lines here to say thanks to a few ppl So thanks go to :
	nIabI of [ME/C4N'97] for gpatch and all your help
	Scorpoin of [ME/C4N'97] for the info on Hiew
	mornings on #cracking4Newbies for testing my tuts
	and anyone i forgot :-) Thanks all .............

 		
		
	
