where. Thanks and enjoy!

--==[  St0rmer  ]==--

_______________________________________________________________


Greets to all my fellow hackers/crackers. This is my
first essay written for fravia, and I doubt it'll be
my last.

This essay is intended for both hackers (interested in
hacking a computer with Fortres
(http://www.fortres.com for more info)) and crackers
(interested in using "real-time" patches). I myself
used to be a beginner with all of this, so I'll go
slowly and try to explain as much as possible.

First, a little background. My high school uses
Fortres to "protect" (haha) the Windows95 computers to
stop students from writing to the hard-drives,
deleting things, etc. I'm always up to a good
challenge, so I began to look for ways to get around
Fortres. I found literally dozens of "holes" in the
security, due to a combination of ignorant
administrators who didn't know how to configure it
correctly and the fact that Fortres just can't protect
a computer 100%, no matter how well it's configured.
However, there was one slight problem to all the holes
I found... they all required rebooting each time I
wanted to deactivate/reactivate Fortres because the
security is run through a VxD (Virtual Device Driver).
If you don't know what that is, it's simply a process
that can't easily be halted while it's running), and
the methods I used to disable Fortres only removed it
from boot-up. Keep in mind, all this time I was
reporting each hole I found to the network
administrator, even though he really didn't care.

A friend of mine who's a programmer by trade (not a
cracker) was also interested in getting around
Fortres, since he knew I had done it. However, instead
of turning the protection off by rebooting, he said,
"if Fortres can disable the security itself (with a
correct password), then it's possible to make a
program to disable the security". Of course, he wasn't
a cracker, so he wouldn't really know how to go about
doing this kind of stuff. But I thought about what he
said, and realized he was right.

When I got home that day I downloaded Fortres 4.0 (the
newest version at the time) from
http://www.fortres.com, cracked the Installshield
installer so I didn't need a password to install it,
and got to work. But before I go into that, let me
start with version 2.0, build 51, and version 3.0,
build 204 (both of which were given to me AFTER I made
a program to crack 4.0). In this case, I'll pretend
like I cracked 2.0 and 3.0 first since they're a bit
simpler. I'll then go on to explain how to crack 4.0,
and any other versions that you find laying around.


Here's the "walkthrough"...

All right, I assume you have Fortres 2.0 installed (I
tested on build 51). If you're using a different
version or build, don't worry; it's still similar.
Make sure you have Softice installed too and running.
Hackers: Softice is a program that allows debugging of
programs so us crackers can see how they work and how
to crack them. Beginner Crackers: if you're not very
proficient with Softice and/or Assembly, read up at
fravia's site. Just make sure you have USER32.DLL
loaded in your winice.dat and that when you go into
Softice you type 'wd' (to enable the Data Window) and
'wf' twice (to enable the floating-point stack window
(list of registers and their values)).

Let's press Ctrl-Shift-Esc to bring up the Fortres
password dialog box. Type in some random characters
and click OK. The box disappeared. Doh, no error
message to search for with a disassembler. We'll have
to take another approach. Ctrl-Shift-Esc again and
enter some random characters. But this time, before
clicking OK, go into Softice by pressing Ctrl-D and
set breakpoints on the common API functions that
retrieve data from text boxes (bpx <command>, where
<command> = GetWindowText, GetWindowTextA,
GetDlgItemText, and GetDlgItemTextA). You should now
have 4 breakpoints set (you usually don't need to use
the API calls without A's since most modern programs
are 32-bit and only use +A's). Press F5 to get out of
Softice, and click OK in the Fortres password box.
Aww... the box disappeared again and Softice didn't
pop up. It must not be using one of the
above-mentioned API calls. Go back into Softice
(Ctrl-D) and do "bc *" to clear all your breakpoints.
I used Dependency Walker on fortres.exe (comes with
Microsoft Visual Studio Enterprise edition) and found
that it uses GetDlgItem. I just wanted to save you the
trouble of having to disassemble it unnecessarily. OK,
do same thing as above, but instead of bpx'ing the
above functions, bpx GetDlgItem (don't worry, it's not
case sensitive). This time Softice should pop up.

Of course we're in user32.dll when Softice comes up
because that's what GetDlgItem is from. So press F11
to fast-forward out of the GetDlgItem function. Keep
F11'ing (should only be once or twice) until you get
into FORTRES!.text. To save you the time, I'll tell
you now that it does GetDlgItem three times; we are
only going to concentrate on the last time. You'll
have to press F11 eight times until you get to the
section of FORTRES!.text we want. Look down at the
code, and what do we see? CALL [KERNEL32!lstrcmp].
lstrcmp compares two strings. Hmmmmmm... could the two
strings be our guessed password and the REAL one???
Let's go line by line (F10) until we get to the first
'push eax' BEFORE lstrcmp. Once we're on 'push eax',
type "d ds:eax" to see what the first string is that's
being pushed. Gee... that looks like a real password!
Go to 'push ecx' and type "d ds:ecx". Gee... that's
our guessed password! Now we know it's possible to
extract the password from an Fset file (the file that
contains the password for Fortres 2.0). Don't get too
excited though, Fortres 4.0 doesn't make it this easy.

Now for a quick run-through for 3.0 (I tested on build
204), don't worry, it's VERY similar to 2.0. Same
deal... set a break point on GetDlgItem. 3.0 runs
GetDlgItem twice, we're interested in the second time.
Press F11 five times until we get to the section of
FORTRES!.text we want, the part with CALL
[KERNEL32!lstrcmp] right below it. This time the first
'push eax' is the correct password. Once you're on the
first 'push eax' line approaching lstrcmp, do "d
ds:eax" as above. There's the password.

Here we go for 4.0 (I tested on build 94). We can keep
using GetDlgItem for our breakpoint, but I prefer
GetWindowTextA for 4.0 since it supports it. OK, let's
Ctrl-Shift-Esc and type in a bogus password. Ctrl-D
and 'bpx GetWindowTextA'. F5 out of Softice, and press
enter to submit your bogus password. Hello Softice!
Let's start looking for that good ol'
[KERNEL32!lstrcmp] we saw in Fortres 2.0 and 3.0.
It'll hopefully come up before any conditional jumps.
Hmm... no luck. It must be inside one of those CALL's.
Again, you COULD trace through the two CALL's below,
but it'd be easier for me just to tell you where to go
and what to look for (if you want to trace through it
for the challenge, go for it!). The first call is to
capitalize your bogus password. We don't care about
this. So we're going to go into the second call. F10
down to it and press F8 to go into the CALL. Blech...
looks like a bunch of yucky code. Looks like we'll
have to trace through everything... that is, unless we
get lucky with the first CALL down there. Let's go
right up to the 'push eax' and since we want to know
what it's pushing into the CALL (as a parameter),
we'll "d ds:eax". Hmm... nothing good, it's probably a
dead end... unless it's a memory location for the
return value of the CALL. Only one way to find out!
F10 past the CALL and what do we get where EAX was?
Four bytes of 00's and the correct password! Kick ass!


Implementation...

Now it would be great if the computers you were trying
to hack in school or wherever had Softice running on
it. Chances are though, they don't. So let's analyze
some options. Most computers in high schools in
Computer Science classes should have some form of
programming language on them. Whether it be C++,
Visual Basic, Delphi, TASM, etc., you should be able
to write a program to reveal the password as long as
you have access. I'll include the source code for the
password revealer I wrote for Version 4.0 build 94
which I wrote in Visual Basic (the primary reason I
used VB instead of C++ was because it's easier to use
Shell() than CreateProcess()). The only thing we need
to know beforehand is the hex offset of the location
the decrypted password is stored in memory. For 4.0,
build 94, the value with the four 00's and password is
&H68E138 (&H<hex value> is used for Hex values in VB;
in C++, 0x<hex value> is used). Just to be clear,
&H68E138 is the value of EAX right before the CALL
that returns the password, described above for 4.0.
Keep in mind, each version is different, and each
build uses different offsets. Here's the VB source
code for revealing a password for Fortres 4.0, build
94 (I'm not the best coder, so this is in no way
"optimized", but it does the trick):

'--------------------------------------------------------
Private Declare Function OpenProcess Lib "kernel32"
(ByVal dwDesiredAccess As Long, ByVal bInheritHandle
As Long, ByVal dwProcessId As Long) As Long
Private Declare Function ReadProcessMemory Lib
"kernel32" (ByVal hProcess As Long, lpBaseAddress As
Any, lpBuffer As Any, ByVal nSize As Long,
lpNumberOfBytesWritten As Long) As Long
Private Declare Function TerminateProcess Lib
"kernel32" (ByVal hProcess As Long, ByVal uExitCode As
Long) As Long

Public ProcessID As Long
Public processhandle As Long
'--------------------------------------------------------
Private Sub Form_Load()
ProcessID = Shell("c:\fgc\appmgr.exe", vbHide)
	'Running appmgr.exe is equivalent to Ctrl-Shift-Esc
(in versions 2.0 and 3.0, it's fortres.exe)
	'We're keeping the password box hidden just for
aesthetics
	'We're saving the Process ID (PID) in variable
ProcessID for use in OpenProcess
processhandle = OpenProcess(PROCESS_VM_READ, False,
ProcessID)
	'This finds the handle (hwnd) of the appmgr.exe
process we loaded
	'We make sure to open it as "PROCESS_VM_READ" so that
we can do the
	'equivalent of "d ds:..."
Dim mylong As Long
Dim mystring(20) As String
Dim myhexaddr As Long
For z = 1 To 20 'Maximum number of characters in
Fortres password is 20
	myhexaddr = &H68E138 + z * 4 'Prepare to receive the
first two bytes in password
	'&H68E138 is the hex address that varies from build
to build
	x = ReadProcessMemory(ByVal processhandle, ByVal
myhexaddr, mylong, &H4, 0)
	'This will do the equivalent of "d ds:myhexaddr"
	mystring(z) = Hex(mylong)
	'Put the 2 bytes of the password into an array for
string conversion later
	If mylong = 0 Then z = 20
	'If no characters left to receive, stop loop
Next z
x = TerminateProcess(processhandle, 0)
	'We're all done with appmgr.exe, so this terminates
it
Dim entirestring As String
For z = 20 To 1 Step -1
	entirestring = entirestring & mystring(z)
	'Traverse the array and put it into a string
Next z
For z = 1 To 20
	mystring(z) = Mid(entirestring, z * 2, 2)
	'Finish up sorting the array of characters
Next z
Dim realpass As String
realpass = ""
For z = 1 To 20
	On Error Resume Next
	realpass = realpass & Chr(CLng("&H" & mystring(21 -
z)))
	'Convert HEX values into ASCII characters
Next z
x = MsgBox(realpass, vbOKOnly, "Fortres password")
	'Display the Fortres password
End
	'Terminate this VB program
End Sub
'--------------------------------------------------------

And that's it! I hope my code is somewhat readable. If
you don't understand it 100%, play around with it.
Like I said, I didn't really go for optimization, I
just wanted to make sure it worked.


Plans for the future...

Well, the whole "secret" on how to "decrypt" Fortres
passwords has now been "revealed". What's next? If
someone wanted to, they could make a standalone
program to import the Fset and/or *.fg* files (the
encypted password files) and have the program decrypt
the password. This shouldn't be too difficult, all
that's required is stripping the code out of
appmgr.exe or fortres.exe (depending on version of
Fortres) that decrypts the password; this is very
similar to how key generators are made.

Another idea I had was that everyone who was
interested in this could find the respective hex
offsets for the version and build of Fortres they have
and submit it to me (st0rmer@hotmail.com). I could
thus make a database of offsets, and incorporate each
offset into a Fortres Password Revealer program that
would let you specify the version you wanted cracked.


Final comments...

I hope this helped all hackers and crackers interested
in breaking through Fortres via reverse engineering.
I'd be happy to receive all comments and questions
(st0rmer@hotmail.com) you might have; however I'd like
to request that you don't e-mail me on "where can I
get the full version of Fortres" or "how do I crack
Fortres so it doesn't give me an UNREGISTERED nag
screen". As of now, you can get the full version of
Fortres from http://www.fortres.com, and you can
install it with WinZip and Windows Installshield
Decompiler. I DO NOT endorse doing this, because this
IS software piracy, which IS illegal.

I implore you to use all the information you gained
from this essay "for good, not evil". Hack Fortres for
the challenge, not to be malicious and delete all the
files on your school's computers. Always report any
security holes you find to the network administrator
(YES, using Fortres to secure the computer is a
security hole in itself, as I'm sure I made evident
from this essay). If you are a system administrator,
just make sure you understand that no matter what you
do, there will always be SOME WAY to get around
security in a Windows95/98 environment. Either use a
different operating system or better system
protection.

Thank you for spending your time reading my work. I
hope it was as enjoyable and insightful for you to
read as it was for me to write.


Greets go out to fravia+, +ORC, HarvestR, Iczelion, Lord
Caligo, __y, Filer, Fourteen, Toxic, TooBad, Santa,
Compudaze, Zio, TDC, Jimmy Jam, Lithium2, VBRunner,
Coinman415, Xcalibur, and Wrexen (in no specific order)