Tips Trik-trik komputer dan internet

Written by: MRHPx aka Rizal
Written on: 1st June 2o11, Purwosari-Pasuruan, Indonesia

HackINTRO
This article is for all levels of readers, there is no difference, Leet, Newbie, across all borders, NO-SARA, We're the one for equality .. Punk rock, oi-oi! : D Previously I would like to convey greetings of respect and friendship to all his fellow hacker who never knew I was in Indonesia, especially fellow veterans h4xx0r amazing .. : D

Have met with trial software or use an alias shareware shareware? Shareware is a trial program (not free) which has limited and requires the user to buy or pay for the software before it can be used in full or no restrictions. This article will try to discuss the most basic of protection schemes paid software (shareware). One scheme is quite popular shareware or Nag dialog box that displays messages about the status of software, whether it has been purchased (Registered) or still trial (Unregistered). Actually this article is a modification of one of the seminar material in mid-2009 I for the education department of Computer Science, at which time I was asked to demonstrate a simple demo of cracking which is often found on shareware scheme.

This article is NOT intended to teach you how to steal or hijack the paid software, but more priority to the understanding of the vulnerability of a system. None of the targets that are used as guinea pigs in this article who is a shareware other party. Target provided is software I personally made, so no other party the aggrieved here unless I am (The period of rest at home after work because writing this article is trimmed and trimmed down because I am a private money used to pay for internet broadband connection to download the compiler Assembler and post articles. .)

To all "Prankster" aka "Not Action Talk Only" which is always negative in assessing the activities of hackers, you should read first before judging .. why are you even that noisy? Though in use of time, effort and money I am personally, not yours! Unable to sign envious ..



Tool On Demand:

1. Ollydbg, you can get in www.ollydbg.de.
2. File target "Target.exe" has been included with this article or visit the website at www.mrhpx.co.nr I (I make it in person to avoid copyright infringement and DMCA law that suck!)
3. Knowledge of the Assembly (Do not know at all is also no problem: D)
4. Red Palmall .. (For motivation and inspiration .. And also help increase government tax revenues of the Republic of Indonesia: D)
5. Rice - Places Terakhir.mp3 .. (The song is good, to update the database of music and soul, remember do not buy bootleg!: D)



Target Description
Character targets as mentioned above is showing Nagscreen or MessageBox at the beginning of the software is run. To eliminate the appearance of Nagscreen MessageBox, the user must make a purchase.
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Screenshot NagScreen
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


Work to be done here is a MessageBox or disable the message dialog box. So the software will not show the MessageBox again early in the software is run for good.

Nothing is more fun in the field of computer security in addition to analyzing the Reverse Engineering Binary file. My colleagues are curious to deface Web site issues, Rootkits, Software Cracking, Penetration Systems, DDoS, Buffer Overflow and the like shall study the Reverse Engineering. From this area that all security issues arise, both about Exploit, Vulnerable or Bugs System and others. Before reading further I highly recommend to you to read the article I entitled "Executable Injection Tutorial - Part 1: MessageBox" and "Executable Injection Tutorial-Part 2-Splash Screen" The second article can assist you in understanding the basis of Reverse Engineering if you difficulty when reading this article.



The Beginning
Run Ollydbg then load "Target.exe" .. The display will look like in the screenshot below. Especially for those who are included in levels rather than a newbie, here you would be able to read the Entry Point (EP) and determine the steps to break the protection.

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


Screenshot Target Load
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

NOTE: Address listed on your computer may vary from that contained in this article. Always follow the address on your computer.

On the main screen, right click-> Search for-> All referenced text strings. After that you will be in a new window that displays a variety of string, try to find and point your mouse on a string that reads "shareware software COOL # 1 in the World and the Subconscious", then double click or press enter.

You will come back to the main window, you just point the mouse one line up precisely address 1314156F in instruction "6A 24" or "PUSH 24". You will see a red arrow "Conditional Jump" or "Leap With Paying attention to the" originating from address 13141533 "EB 3A".

MessageBox (Win32 Programmer's Reference)
MessageBox function creates, displays and operates a message dialog. The dialogue message includes a picture-messaging application and title, plus various combinations of button press and the icons that are known.

Info
Windows NT: Yes
Win95: Yes
Win32s: Yes
Import Library: user32.lib
File Header: winuser.h
Unicode: WinNT, Win95
Platform Notes: None

Syntax
int MessageBox (
HWND hWnd, / / ​​handle of owner window
LpText LPCTSTR, / / ​​address of text in message box
LpCaption LPCTSTR, / / ​​address of title of message box
Uint uType / / style of message box
);

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$


Screenshot Assembly Code
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$



Logical, Analyze, ATTACK .. CRACKadabra! ™
When the software is run will go directly to the address 13141533 "EB 3A". Which serves to carry the instruction at address 1314156F "PUSH 24" which contains Nagscreen or MessageBox. At address 13141586 "CMP EAX, 7" software to conduct examination, namely:

1. If the user presses the "No" address 13141589 "JE SHORT TARGET.1314158D" then the code will be landed at address 1314158D "PUSH 0" which will cause the software exit.
2. Meanwhile, if the user presses the "Yes" address 1314158B "JMP SHORT TARGET.13141594" then the code will be landed at address 13141594 "PUSH 0" which will cause the software runs normally.

From the above analysis data, one finds several methods that can be used to disable Nagscreen or MessageBox. I'm not the type of hacker who stingy or stupid and matre Hacker types who like to sell fast Hacker techniques stale, like most expensive book Hackers often you find in online and offline bookstores around you. I do not want to just give one method alone, I prefer to give you some methods in solving problems. People who have only one method of strategy in the face of the opponent is a pretty silly. Several methods can be used, namely:

1. Method 1 - JUMP

Change the leap, it is the most effective and efficient manner. Ie change the direction of the jump instruction, this technique requires only 1 byte value changes only!

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Screenshot Method 1 - JUMP
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

To apply this technique is fairly easy, at address 13141533 "JMP SHORT TARGET.1314156F", change the value of "EB 3A" to "EB 5F". This will make the software ignore or MessageBox Nagscreen code and go directly to the address 13141594 "PUSH 0" to run the program normally .. WITHOUT NAGSCREEN!
2. Method 2 - NOP

Negate the process of instruction, this method is effective but less efficient way to remember a lot of Code Cave formation. That is by eliminating some instruction in a way that does not change as the instruction is executed.

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Screenshot Method 2 - NOP
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

To apply this technique, simply block the cursor from the address 1314156F "PUSH 24" up to 13,141,581 "CALL " (see Screenshot Assembly Reference Code). Then right click-> Binary-> Fill with NOPs. This will make the software no longer has Nagscreen or MessageBox, though instructions are still there but the examination did not affect the performance of the software. That way the software will go to address 13141594 "PUSH 0" to run the program normally .. WITHOUT NAGSCREEN!

Final Notes
The task has been successfully done properly, the software "Target.exe" no longer displays Nagscreen or MessageBox. Easy is not it? Not until 1 minute, Nagscreen successfully overpowered. Software "Target.exe" is just one obvious example of bugs due to negligence Programmer shareware (Maybe programmers went to college majoring in management science and animal health as I am, so a little forgotten about the programming the right way: D). Why is that? Because of the above techniques use "Text String" as a reference.

If only the software using technologies such as obfuscation or hiding a string of course will not be as easy as it successfully disabled. Believe it or not, nearly 70% of shareware software worldwide use and display the MessageBox Nagscreen or Text String! Mainly domestic production shareware software! I'm sure you can imagine how complicated life as a programmer with the risk of their software pirated. Advice for you, never use pirated software. If you do not have money, menabunglah, buy an official license if you already have the money or use Open Source. Programmers also need to eat, they sell the software to be earning. Hacker was born to help others, not harming others. Hopefully this article useful to you and I can help you secure yourself from cyber crime. I am a hacker .. I am a Cracker .. But I am still a Farmer! :)

CONTACT ADDRESS
Website: www.mrhpx.co.nr
Mirror: www.mrhpx.astalavista.ms
Email: mrhpx [@] yahoo.com / nemesisbyte [@] yahoo.com / mrhpx [@] binushacker.org
Facebook: www.facebook.com / mrhpx (Send Message Add a new first, to avoid spammers!)

Greetz:
My Family .. My Love .. My Cats .. My God and Prophet .. AstaLaVista .. 0day .. All WHO friends help me a lot in IRIS Until this day, Lucifer, BlackStorm, Beat Jaya, BinusHacker, IRC, UCF, dT, AGAIN, water, LZ0, FOSi, assign, DVT, 29A, TSRh, tPORT, FFF .. All Indonesia veterans haxx0r .. Underground communities .. Fellow in college at Univ. Islam Malang, Univ. UB Malang, Univ. Malang .. Colleagues at the PT. Malindo Feedmill, PT. Patriot Panca Prima, PT. Joyo Wonokoyo herein, PT. Samsung Cheil Jedang Group, PT. Charoen Pokphand Indonesia and My Family Bussines Company (Mutter.. Vermogen Ich, Ich versuchen, Ich niemals Mude.)