From: <Guardado por Microsoft Internet Explorer 5>
Subject: Kmos CrackMe1 tutorial
Date: Wed, 5 Feb 2003 21:22:35 +0100
MIME-Version: 1.0
Content-Type: multipart/related;
	boundary="----=_NextPart_000_0000_01C2CD5C.B3E3C7D0";
	type="text/html"
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2600.0000

This is a multi-part message in MIME format.

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: text/html;
	charset="Windows-1252"
Content-Transfer-Encoding: quoted-printable
Content-Location: file://F:\Punto_H_ingles.htm

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<!-- saved from =
url=3D(0054)http://www.rohanpall.com/ollydbg/files/luucorp_003.htm =
--><HTML><HEAD><TITLE>Kmos CrackMe1 tutorial</TITLE>
<META http-equiv=3Dcontent-type content=3D"text/html; =
charset=3Dwindows-1252"><!-- page title -->
<META content=3D"MSHTML 6.00.2600.0" name=3DGENERATOR></HEAD>
<BODY>
<STYLE type=3Dtext/css>BODY {
	FONT-SIZE: 8pt; BACKGROUND: #eeeeff; FONT-FAMILY: =
verdana,geneva,arial,helvetica,sans-serif; TEXT-ALIGN: justify
}
A {
	COLOR: #000000
}
PRE {
	FONT-SIZE: 8px; MARGIN: 1% 0% 0% 5%; FONT-FAMILY: terminal
}
.header {
	BORDER-RIGHT: #000000 1px solid; BORDER-TOP: #000000 1px solid; =
FONT-WEIGHT: 800; BACKGROUND: #b2bff2; MARGIN-BOTTOM: 1%; BORDER-LEFT: =
#000000 1px solid; BORDER-BOTTOM: #000000 1px solid; LETTER-SPACING: =
0.3em; TEXT-ALIGN: center
}
.attn {
	COLOR: #ff0000
}
</STYLE>

<CENTER><B><FONT size=3D5><!-- tutorial title -->Point-h in WinXP =
tutorial=20
</FONT></B><BR><!-- author name -->by Ricardo Narvaja | email=20
ricnar22@millic.com.ar<BR><!-- date -->22.Dec.2oo2 </CENTER><BR><BR>
<DIV class=3Dheader>Description</DIV>How made a similar point like =
Hmemcpy of Sice=20
with OllyDbg in Windows XP<BR><BR>
<DIV class=3Dheader>Target</DIV><A=20
href=3D"http://www.crackmes.de/download.php/ex-kcrk1.zip?Crackme=3D390">C=
rackme v1.0=20
de Cruehead http://www.darmozjad.host.sk/import.php3</A> <BR><BR>
<DIV class=3Dheader>Tools</DIV><A=20
href=3D"http://home.t-online.de/home/OllyDbg/download.htm">OllyDbg =
1.08b</A>=20
<BR><BR>
<DIV class=3Dheader>Tutorial</DIV>Abstract=20
<P>The subject of this tutorial is to show how it is possible to find a =
point in=20
the system OllyDbg+WinXP that works in a similar way to API Hmemcpy in =
Windows=20
98, in other words, that executes a breakpoint when inserted a name or =
serial=20
and that shows where these data are stored.<BR>That point (from now =
denominated=20
" point-h ") it is unique for each machine and it is found in =
USER32.DLL. Once=20
found we can apply the point-h in C++, VB, Delphi, ASM, or any other =
programming=20
language simply placing a breakpoint memory on access in the =
point-h.</P>
<P>How to find the point-h in my computer</P>
<P>In first place we should locate the point-h. For that, we will use =
the=20
crackme of Cruehead once that crackme doesn't generate exceptions and it =
is=20
quite simple (but obviously any other program can be used). The =
step-for-step=20
procedures are described below:</P>
<P>1) Open Cruehead crackme in Olly<BR>2) Search for Name (Label) in =
current=20
module and choose API TranslateMessage (FIGURE 1)</P>
<P><IMG height=3D346 =
src=3D"file:///F:/Punto_H_ingles_archivos/image001.jpg"=20
width=3D566><BR>FIGURE 1</P>
<P>3) Once on API make right-click with the mouse, chose CONDITIONAL LOG =

BREAKPOINT ON IMPORT and setup the window as show in FIGURE 2</P>
<P><IMG height=3D320 =
src=3D"file:///F:/Punto_H_ingles_archivos/image002.jpg"=20
width=3D456><BR>FIGURE 2</P>
<P>NOTE 1. In some systems MSG=3D=3D201 doesn't work for the =
determination of the=20
point-h. In this case we should use MSG=3D=3D202.</P>
<P>4) RUN (F9) the program.<BR>5) Put values in the edit boxes (FIGURE =
3)</P>
<P><BR>Name : narvaja<BR>Serial: 1A2B3C4D5E</P>
<P><BR><IMG height=3D204 =
src=3D"file:///F:/Punto_H_ingles_archivos/image003.jpg"=20
width=3D290><BR>FIGURE 3</P>
<P>NOTE 2. Of course you can put any value for name and serial but the=20
1A2B3C4D5E serial it is a value easy to look for in the memory and that =
doesn't=20
repeat.</P>
<P>6) Press the OK button<BR>7) Olly stops in the conditional breakpoint =
(FIGURE=20
4)</P>
<P><IMG height=3D346 =
src=3D"file:///F:/Punto_H_ingles_archivos/image004.jpg"=20
width=3D566><BR>FIGURE 4</P>
<P>8) Open MEMORY in VIEW menu (Alt+M), make right-click in MEMORY MAP =
window=20
and choose SEARCH. In ASCII field put the 1A2B3C4D5E serial (FIGURE =
5).</P>
<P><IMG height=3D203 =
src=3D"file:///F:/Punto_H_ingles_archivos/image005.jpg"=20
width=3D369><BR>FIGURE 5</P>
<P>9) Olly will stop when it finds the sought serial (FIGURA 6). Then we =
marked=20
the serial and we put BP MEMORY ON ACCESS.</P>
<P><IMG height=3D283 =
src=3D"file:///F:/Punto_H_ingles_archivos/image006.jpg"=20
width=3D544><BR>FIGURE 6</P>
<P>10) RUN (F9).... Olly will stop exactly in the point-h (FIGURA =
7).</P>
<P><IMG height=3D283 =
src=3D"file:///F:/Punto_H_ingles_archivos/image007.jpg"=20
width=3D544><BR>FIGURE 7</P>
<P>77D29303 F3:A5 REP MOVS DWORD PTR ES:[EDI],DWORD PTR DS&gt;</P>
<P>This is it point-h for my system. The crackme of Cruehead was used =
only to=20
find the point-h. In the follow examples we will see that we can set a=20
breakpoint in the point-h in a similar way to the that we do with =
hmemcpy in=20
Win98.</P>
<P>&nbsp;</P>
<P>EXAMPLES OF USE OF THE POINT-H</P>
<P><BR>EXEMPLE 1. In this first example we will use the Cosh=B4s =
crackme2. The=20
procedures are described below:<BR><BR>1) Open crackme2 in Olly. Put the =
name=20
and the serial as shown in the FIGURE 11<BR><BR><IMG height=3D191=20
src=3D"file:///F:/Punto_H_ingles_archivos/image008.jpg" =
width=3D186><BR>FIGURE=20
11</P>
<P><BR>2) In the sequence, if we used Windows 98 we would put a HMEMCPY. =

However, in our case, we will place a BPX in the point-h. As the point-h =
is=20
located in USER32.DLL, we have to go to the menu VIEW-EXECUTABLE MODULE, =
make=20
double-click in USER32 (the USER32 window will open), GO TO (Ctrl+G) =
77D29303=20
(point-h of my system) and set breakpoint mermory on access (FIGURE =
12).</P>
<P><IMG height=3D283 =
src=3D"file:///F:/Punto_H_ingles_archivos/image009.jpg"=20
width=3D544> <BR>FIGURE 12</P>
<P><BR>3) Goto to crackme2 window and press CHECK</P>
<P>NOTE3. If you press PAUSE and setup BPX in point-h then press RUN =
(F9) and=20
CHECK.</P>
<P>4) Olly stops in point-h (FIGURE 13).</P>
<P></P>
<P></P>
<P></P>
<P></P>
<P><IMG height=3D431 =
src=3D"file:///F:/Punto_H_ingles_archivos/image010.jpg"=20
width=3D648><BR>FIGURE 13</P>
<P>This pause is exactly equal that HMERMCPY in Windows 98. The first =
stop in=20
point-h is related with NAME (observe the name "narjava" in the register =
ESI).=20
If we press RUN (F9) one more time the program stops again: this time =
the stop=20
is related with SERIAL (ESI =3D ASCII "989898" , FIGURE 14).</P>
<P><IMG height=3D283 =
src=3D"file:///F:/Punto_H_ingles_archivos/image011.jpg"=20
width=3D544><BR>FIGURE 14</P>
<P>This stopped it happens so that it is possible to insert the name in =
program:=20
the instruction REP MOV [EDI],ESI tells us that the serial will be =
inserted in=20
EDI. Therefore, we should mark FOLLOW IN DUMP in the registration EDI =
and press=20
F8 until the serial is loaded in DUMP (in other words, F8 until the call =

USER32.77D28C15 (or equivalent in your machine), as show in FIGURE 15). =
Go to=20
the dump, mark the fake serial (393839383938), set breakpoint memory on =
access=20
and RUN (F9). </P>
<P><BR><IMG height=3D326 =
src=3D"file:///F:/Punto_H_ingles_archivos/image012.jpg"=20
width=3D552><BR>FIGURE 15</P>
<P>Olly will stop in kernel32. Make RUN (F9) until the program go to =
crackme2=20
module.<BR>Now we can observe that Olly stopped exactly in the check =
point of=20
crackme. ?</P>
<P><IMG height=3D448 =
src=3D"file:///F:/Punto_H_ingles_archivos/image013.jpg"=20
width=3D623><BR>FIGURE 16</P>
<P></P>
<P></P>
<P><BR>EXAMPLE 2.<BR><BR>Idesk is a UPX packed delphi program. The =
program can=20
be unpacked easily (for exemple with Generic Unpacker W32... ?). In Dede =
the=20
unpacked file shows little information. However, applying the point-h =
method we=20
can quickly find a valid serial.:</P>
<P><BR>1) Open Idesk (UNPACKED) in Olly<BR>2) RUN (F9) the program<BR>3) =
Click=20
OK and open the main window (arrow down on the right side, FIGURE =
17)</P>
<P><IMG height=3D80 =
src=3D"file:///F:/Punto_H_ingles_archivos/image017.jpg"=20
width=3D280><BR>FIGURE 17<BR></P>
<P>4) Click in ? (FIGURE 18), ACERCA DE IDESK and push REGISTRAR botton. =
The=20
register window opens. In this case, the serial number (N=DAMERO DE =
VALIDACI=D3N)=20
its in the first edit box (FIGURE 19)</P>
<P><BR><IMG height=3D207 =
src=3D"file:///F:/Punto_H_ingles_archivos/image018.jpg"=20
width=3D280><BR>FIGURE 18</P>
<P><BR><IMG height=3D273 =
src=3D"file:///F:/Punto_H_ingles_archivos/image019.jpg"=20
width=3D305><BR>FIGURE 19</P>
<P>5) Put a N=DAMERO DE VALIDACI=D3N (Serial) and a USU=C1RIO (Name). =
Observes that=20
N=DAMERO CLAVE 55157265 is a dependent machine number.<BR>6) Set the =
point-h (see=20
example 1)<BR>7) RUN (F9). The program stops in point-h (Serial =
editbox).<BR>8)=20
Now, RUN (F9) for input Name and (F9) again for input the serial. </P>
<P>9) Put FOLLOW IN DUMP in the register EDI and trace until call=20
USER32.77D28C15 (or equivalent in your machine) as show in FIGURE =
20.<BR>10)=20
Mark the serial (989898 in this case) in dump and set breakpoint memory =
on=20
access.</P>
<P><IMG height=3D285 =
src=3D"file:///F:/Punto_H_ingles_archivos/image020.jpg"=20
width=3D521><BR>FIGURE 20</P>
<P><BR>11) The program stops Idesk Module:</P>
<P>00402E0F 8A1E MOV BL,BYTE PTR DS:[ESI]</P>
<P>12) Trace with F8 to exit this routine (retn) and the program go to =
the check=20
point of serial:</P>
<P>004C9DB6 A3 04B55200 MOV DWORD PTR DS:[52B504],EAX<BR>004C9DBB A1 =
00B55200=20
MOV EAX,DWORD PTR DS:[52B500]<BR>004C9DC0 3B05 04B55200 CMP EAX,DWORD =
PTR=20
DS:[52B504]</P>
<P><BR>In 004C9DC0 the program compare F1ACA (=3D989898d) with 7CE55.=20
<BR>Therefore, the correct serial is 511573 (=3D7CE55h) ?</P>
<P><IMG height=3D172 =
src=3D"file:///F:/Punto_H_ingles_archivos/image021.jpg"=20
width=3D192> </P>
<P><BR>If you have the olly command bar pluggin you can put a breakpoint =
in=20
point-h directly ((in other words, it is not necessary to look for =
point-h in=20
USER32).<BR></P>Ricardo Narvaja<BR><BR><BR><BR><BR><BR><BR><BR><BR><BR>
<DIV class=3Dheader>Final notes</DIV>
<P>Any doubts, enter in contact with me or with CracksLatinos: =
<BR>ricnar?????=20
<BR>dalnet #crackslatinos</P>
<P>Dedicate to all members of the Crackslatinos =
List<BR></P></BODY></HTML>

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image001.jpg

[encoded data, 58504 characters]

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image002.jpg

[encoded data, 30780 characters]

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image003.jpg

[encoded data, 10412 characters]
MXiYsqXeUfii/DtOKLdoX//Z

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image004.jpg

[encoded data, 67640 characters]
inWeFkQB15bLY4MVDUTzJPz4MeshTjShGnHUkl4Gum3mz//Z

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image005.jpg

[encoded data, 19000 characters]
+uVH/9k=

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image006.jpg

[encoded data, 80408 characters]
ig5Xs1n4mmrXqVY7srH/2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image007.jpg

[encoded data, 62472 characters]
oy0dooF0wRfxWNWvUqt1XQv/2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image008.jpg

[encoded data, 10488 characters]
h//Z

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image009.jpg

[encoded data, 58368 characters]
/9k=

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image010.jpg

[encoded data, 80864 characters]
3GQRnvm8/wDy0V+o6D6ExmBsVW7tKludTW5Hlu9J4WpyquT9j//Z

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image011.jpg

[encoded data, 63984 characters]

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image012.jpg

[encoded data, 71440 characters]
DXi/FirO+K8y4gRFzGdpjGCELAbX+gfNgwYMWskkkrImKP/Z

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image013.jpg

[encoded data, 88008 characters]
LSmj/9k=

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image017.jpg

[encoded data, 8588 characters]
zADzYfQBXaP/AGfrf7v/AM4mMGeZ5llVktVDDWxPI8dlUHnxMED/2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image018.jpg

[encoded data, 17936 characters]
Fa61TG9HpuQafcdemXHHlKLWFJWs4lWFzYXvbM2Fhc7YI0irhk//2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image019.jpg

[encoded data, 27740 characters]
oDRo0aD/2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image020.jpg

[encoded data, 50616 characters]
Ou7ecVyvlK3XEH//2Q==

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0
Content-Type: image/jpeg
Content-Transfer-Encoding: base64
Content-Location: file:///F:/Punto_H_ingles_archivos/image021.jpg

[encoded data, 9724 characters]

------=_NextPart_000_0000_01C2CD5C.B3E3C7D0--
