snatch1.htm

An interesting tool: Numega Smartcheck 5.0
Echoing a silly "install" and trial protection scheme

by Snatch

(27 October 1997, slightly edited by fravia+)

Courtesy of fravia's page of reverse engineering

Well... this happens ofter and ofter nowadays: I was preparing my own "An interesting tool: Numega's Smartcheck 5.0" essay... and Snatch has "snatched" it before me.
Well, the minimum that Snatch can do after having spoiled my "in fieri" essay :-) is to allow me a somehow long introduction to his essay: here it is.

Smartcheck is an interesting tool indeed... yet you must be careful and set it up corrrectly: program/settings: Default: detect and report everything
program/settings/advanced: check everything, don't suppress anything and don't forget to "check program compliance" before delving in... as soon as you use it you'll easily understand that this program is a very important addition to our tools arsenal.

In fact the real funny question is: "Why does Numega use such stupid protections?". Mind you, we are not speaking of a small shareware programmer that is using some overbloated language for some overbloated useless application: we are speaking of the BEST programmers and wizards of assembly in the whole planet here!

The fact that Numega (which, differently from Micro$oft lamers' park, HAS INDEED A LOT of said good programmers and wizards) publishes powerful disassembly and reversing tools (Bondcheck, Smartcheck, Softice...) in downlodable "trial" version with pretty silly protections (as if the kind of people that REALLY USE such tools were not capable of earing a password echo in memory) can IMO only mean two things:

A) EITHER Numega follows the Micro$oft path of giving away everything for free, in the hope that they will dominate the disassembler "commercial" markt and get the rewards from "scale" economy.
This may happen: it is clear that the crackers and "simple" programmers of to-day, i.e. a great part of the people that peruse the many available sites like mine, ARE the reverse engineers of to-morrow (who else?), and will be able to afford *any* "commercial" fare that Numega will in the future decide for, say, Smartcheck version 13.0.
B) OR that Numega will bring to light a very tough protections (the mytical "unbreakable" software protection :-) as soon as their absolute dominance of the market has been asserted. Let's hope they do it soon: the "protections" (if you really want to call them so) that they are using at the moment are simply too boring to bother

And here is the short essay by Snatch, sorry for the long introduction


Cracking Numega Smartcheck 5.0
by Snatch

I was recently tipped off that Numega's Smartcheck could 
reverse visual basic files so I downloaded the demo from 
this site:
ftp://ftp.ultranet.com/pub0/n/numega/files/smchk50.exe (about 7.19 megs)
The first thing I noticed when I ran the setup file was a 
password to start the setup program.  
So I went into Softice ver 3.21(very nice indeed), and set a bpx 
getwindowtext.  Then type in a dummy password and click OK. 
After stepping through the routine(F10), you find that there is:

CALL USER!GETWINDOWTEXT >> Get what you typed
LEA AX,[BP-32] >> Load AX with address of what you typed
PUSH SS >> Segment of what you typed
PUSH AX >> Offset of what you typed
PUSH DS >> Segment of real password
PUSH 06BA >> Offset of real password
CALL USER!LSTRCMP >>Comparison of strings at ss:ax and ds:09d6

Next you do a dump of 06ba:
d ds:06ba l 64

You should see the password, &Smc50-14d% there in front of your eyes.  
Type bd * to disable your breakpoints, ctl-d to run and get an error, 
and then run the setup again and type the right password to bypass 
that silly message.
Now we are one-fourth of the way done!  It was that easy!
After going through a few screens, you will see your name, company plus 
a serial number!  I tried to crack the serial number but gave up.  
Don't worry, we can still crack this later on, and much easier and 
quicker.  So simply install it.  And run it :-)
Now load a program (must be 32-bit which is why this program won't 
help me too much with vb programs).  Now try program and start.  
Uh-Oh!  Name of thr trial user, blue "trial meter" and registration 
number.  
Phew!, there is a purchase button.  Let's click it.  Here it is, 
unlock code and all.  Nice, lets go back to the debugger.  
be * for our breakpoints to be re-enabled.  
Now enter your name and company and a dummy password.  
BOOM!  your in the debugger.  Now step and step and step and step 
until you get to a patch of code that looks like this:

ADD ESP,04
LEA EAX,[EBP-14] >> Your password
LEA ECX,[EBP-28] >> The correct password
PUSH EAX >> Your password
PUSH ECX >> The correct password
CALL 10005680

Here you have it!  Type a d ecx l 64, and the first 16 bytes are 
the right code.  
Numega is using a hashing of your name and password and reg number 
to get the code so for everyone the code will be different.  
Now back to reality, write down those 16 numbers and disable 
your breakpoints, 
bd *, 
now ctl-d.  
Keep your name and company the same, enter the password in and you 
are a *registered* user of numega smartcheck 5.0, with your own user 
name and password!

**Note, you could have probably reversed this protection scheme, 
also, individuating both passwords I have described by editing the 
memory and changing the jumps to noop's but I "trust more" the real 
and correct password!

Snatch '97

You are deep inside fravia's page of reverse engineering, choose your way out:

Back to project 7 (stupid protections)

Back to project 2 (Numega's own)

is reverse engineering legal?

by Snatch (27 October 1997, slightly edited by fravia+)

by Snatch

(27 October 1997, slightly edited by fravia+)