dhx.reme.1.exe

Introduction:

Hi, today we wanna reverse dihux's ReverseMe #1. It's a nice target and not too difficult cause he has already done some things for us.
Note for Ollydbg: After every change you make, right click on the changed line(s) and choose copy to executable. A new window with the diassembly of our file including our changes pops up. When you try to close it, Ollydbg asks you to save the changes. Choose "Yes" and all changes are saved to file!
Ok let's have a look at our target. Start it and we see two edit fields, a 'Do'-button which is disabled and a close button. That's all. So open readme.txt to see what to do (listed below).

First of all we should get an overview over the file. So open the file in Ollydbg, we land at the entrypoint (4013D5), set a breakpoint on the next line (4013D7) with F2, start the reverseme with F9 and go on tracing with F8.

Perhaps you've noticed it.... we just trace the stuff generated by the c++ compiler. Step into that call at 401558 with F7 to get to the reverseme itself. Well, looks much better, doesn't it. We see that icons are loaded, the main window is registered and created, we also see the message loop (GetMessage, TranslateMessage) and so on... But where are the edits created? Where are the messages processed? We need to find the window procedure where these things are done. Cause the file is so small, we could just look around and we'll find it immediately. But let's do it the 'right way'. Look here:

Every main window which is created with CreateWindow or CreateWindowEx must be registered with RegisterClass or RegisterClassEx. Both functions take as parameter a structure called WNDCLASS for RegisterClass or WNDCLASSEX for RegisterClassEx. One member of this structure (called lpfnWndProc) is a pointer to the window procedure.
Here in our file it's 401000. So let's scroll up there in Ollydbg. We see the well-known case-loop where the messages are checked (Ollydbg even points it out, what a great tool!).

Task 1 - Enable the Do Button

Let's go to the WM_CREATE branch cause there the edits and buttons must be created there. We see this:

Ok, here is our button created. All necessary parameters are pushed on the stack before calling CreateWindowEx (because of the ascii "Do" & "Button" we know we are dealing with the right button). and what we see after this? dihux helped us really a lot. He disabled the button using the API function EnableWindow. To enable the button, we simply replace at 4011F2 the "push 0" (false) with "push 1" (true).
Click on this line in Ollydbg, hit space, type in "push 1", press return to assemble, press esc to get back, mark this line again, right click and choose "copy to executable file". You could also use a Hex Editor and change at offset 5F2 this 6A00 to 6A01. Then you should use a copy of our file, otherwise you'll get an error cause it's already opened in Ollydbg. Ok first task is solved.

Ok we have to react when the Do-Button is pressed. So we have to check to WM_COMMAND branch and we see this:

Very good the text is already taken from the edit and dihux give us with the nops some space so we don't have to overwrite code. It's not that much of space but enough for inserting a jump to an empty space.
We need space to insert our code but also to store the strings for our messagebox. Let's check the section table:

Ok, our strings we'll insert in the .rdata section. We can insert them from offset 4200h + 124Ah = 544Ah. We have room for 1400h - 124Ah = 1B6h bytes (that's more than enough).
Open you hex editor, go to offset 544A and insert you strings like this (perhaps you have to close our file in Ollydbg in order to save the changes):

00005430 7973 7465 6D49 6E66 6F00 5D03 5669 7274 ystemInfo.].Virt
00005440 7561 6C51 7565 7279 0000 4D61 7869 6D75 ualQuery..Maximu
00005450 6D20 6973 2031 3020 6368 6172 6163 7465 m is 10 characte
00005460 7273 2100 4572 726F 7221 0000 0000 0000 rs!.Error!......
00005470 0000 0000 0000 0000 0000 0000 0000 0000 ................

We remember : caption is at offset 544A = 40624A virtual address; caption at offset 5464 = 406264.
Our code we can insert from raw offset 400h + 3D48h = 4148h (virtual address 404D48).
So back in Ollydbg we insert at 401059 our jump to our "code cave":

00401053 . FF15 EC504000 CALL DWORD PTR DS:[<&USER32.GetDlgItemTextA>]; \GetDlgItemTextA
00401059 E9 EA3C0000 JMP dhx_reme.00404D48
0040105E . 90 NOP
0040105F . 90 NOP
00401060 . 33C9 XOR ECX,ECX

There we insert the following code (don't forget to hit "copy to executable file" after this):

00404D48 83F8 0A CMP EAX,0A ; compare eax with 10
00404D4B 77 05 JA SHORT dhx_reme.00404D52 ; if so jump to 404D52 (to the messagebox)
00404D4D E9 0EC3FFFF JMP dhx_reme.00401060 ; jump back
00404D52 6A 00 PUSH 0 ; from here on show messagebox with error message
00404D54 68 64624000 PUSH dhx_reme.00406264 ; ASCII "Error!"
00404D59 68 4A624000 PUSH dhx_reme.0040624A ; ASCII "Maximum is 10 characters!"
00404D5E 6A 00 PUSH 0
00404D60 FF15 00514000 CALL DWORD PTR DS:[<&USER32.MessageBoxA>>; USER32.MessageBoxA
00404D66 E9 4BC3FFFF JMP dhx_reme.004010B6 ; jump back to 4010B6

Directly after the call to GetDlgItemTextA we jump here. In eax is stored the length of text which the function GetDlgItemTextA has read into its buffer. If it's 10 or less, we jump back where we came from. If it's larger than 10, we display a messagebox with our inserted strings and jump to 4010B6. Why 4010B6? It's the end of the "Do-button routine"; if we have more than 10 chararcters we don't want any serial calculation and that stuff... just go out of the routine.

Task 3 - set the generated serial to the second edit box

After we checked the text, the serial calculation follows which I don't discuss here (it's a very simple algo) and then we come to this:

0040108A > 890D 70744000 MOV DWORD PTR DS:[407470],ECX
00401090 . 8B15 70744000 MOV EDX,DWORD PTR DS:[407470]
00401096 . 52 PUSH EDX ; /<%X> => 0
00401097 . 68 C4514000 PUSH dhx_reme.004051C4 ; |Format = "%X"
0040109C . 68 74744000 PUSH dhx_reme.00407474 ; |s = dhx_reme.00407474 <- our serial is string
004010A1 . FF15 F0504000 CALL DWORD PTR DS:[<&USER32.wsprintfA>] ; \wsprintfA
004010A7 . 83C4 0C ADD ESP,0C
004010AA . 6A 00 PUSH 0 ; /Text = NULL; <- have to change this
004010AC . 6A 00 PUSH 0 ; |ControlID = 0;<- and this
004010AE . 6A 00 PUSH 0 ; |hWnd = NULL ;<- and this
004010B0 . FF15 F4504000 CALL DWORD PTR DS:[<&USER32.SetDlgItemTextA>] ; \SetDlgItemTextA

The serial is converted to a hexadecimal string using wsprintfA. Dihux has already implemented the SetDlgItemTextA function for us at the right place, we have just to push the right parameters. But the room is a bit small, for every parameter pushed we have just 2 bytes. But for example push [ebp+8] is FF7508, that means 3 bytes. So we jump down again to the end of the section where we have room. So we change it into this:

004010A7 83C4 0C ADD ESP,0C
004010AA E9 BC3C0000 JMP dhx_reme.00404D6B ; jump down to inserted code
004010AF 90 NOP ; cause jump instruction is only 5 bytes long, fill last byte with a nop
004010B0 FF15 F4504000 CALL DWORD PTR DS:[<&USER32.SetDlgItemTextA>] ; \SetDlgItemTextA

At 404D6B we insert this:

00404D6B 68 74744000 PUSH dhx_reme.00407474 ; push serial string
00404D70 6A 66 PUSH 66 ; push ID of serial edit
00404D72 FF75 08 PUSH DWORD PTR SS:[EBP+8] ; push handle of main window
00404D75 E9 36C3FFFF JMP dhx_reme.004010B0 ; jump to SetDlgItemTextA

The 407474 I get from the last argument pushed for the function wsprintf. To find out the control ID, you can use a tool, for example "The Customizer" or you go back to the place where the edit is created to find where the ID is pushed. (here: 0040112E . 6A 66 PUSH 66). The handle of the main window is nearly always at [ebp+8] stored.

Task 4 - lock second edit box

What dihux mean is not to disable the edit box, we should just make it readonly. So let's go back where the edit box is created:

0040112B > 6A 00 PUSH 0
0040112D . 57 PUSH EDI
0040112E . 6A 66 PUSH 66
00401130 . 56 PUSH ESI
00401131 . 6A 14 PUSH 14
00401133 . 68 AA000000 PUSH 0AA
00401138 . 6A 23 PUSH 23
0040113A . 6A 0A PUSH 0A
0040113C . 68 00000050 PUSH 50000000 ; <- our window style
00401141 . 68 C1514000 PUSH dhx_reme.004051C1
00401146 . 68 BC514000 PUSH dhx_reme.004051BC ; ASCII "EDIT"
0040114B . 68 00000200 PUSH 20000
00401150 . FFD3 CALL EBX ; call CreateWindowEx

This is how the second edit box is created. The 4th last argument pushed before calling CreateWindowEx is "window style". Here it is 50000000. Now we have to add the atrribut ES_READONLY. The constant for ES_READONLY is 800h. We know that the styles are combined to one using a "logical or". So we have to calculate: 50000000h or 00000800h = 50000800h. Just change push 50000000 to push 50000800 and that's all!

We have successfully reversed dihux's ReverseMe #1. Was quite funny and not too difficult! Hope c u soon again in my next tut!
Questions, criticism? Mail me!

Sunshine, July 2003

This site is part of Sunshine's Homepage

Target :	dihux's ReverseMe #1 File : dhx.reme.1.exe (23 kb)
Downloaded from :	New2Cracking
Author of target:	dihux
Tools used :	Ollydbg (I used 1.09), Hex Editor, PEditor or LordPE Win32 API reference, API constant listing a bit knowledge about Win API and assembly...

Section	Virtual Size	Virtual Offset	Raw Size	Raw Offset
.text	00003D48	00001000	00003E00	00000400
.rdata	0000124A	00005000	00001400	00004200
.data	00000818	00007000	00000400	00005600