Reverse engineering a software crack

https://twitter.com/gf_256/status/1782656618015904103

by nharada • 2 years ago

213 87 2 years ago

twitter.com

skilled2• 2 years ago

https://nitter.poast.org/gf_256/status/1782656618015904103

_aavaa_• 2 years ago

Thank you! This really should be the link, the twitter link is unusable

dewey• 2 years ago

This says „Tweet not found“ now.

skilled2• 2 years ago

It works fine but does lag sometimes. It’s the only public Nitter instance that is reliably up since nitter.net was shut down or whatever else happened to it.

Your error has happened to me also but it does eventually work.

littlestymaar• 2 years ago

Oh, a Nitter instance that still works?

I guess it's going to die soon like the other as they run out of guest accounts from scrapping…

doix3• 2 years ago

This was a pretty long read and I didn't really get much from it. The format of a million tweets is awful.

tl;dr it patches the executable by having a shim dll that does the patch when it gets loaded. Pretty common in the game modding community. It finds where it needs to patch by scanning for a byte pattern.

What does the actual patch do? No idea, that's what I was waiting for and I never got it. I was expecting a disassembly comparison of the before and after.

Someone please correct me if I'm wrong.

fullspectrumdev2• 2 years ago

As far as I can tell - and I could be wrong having spent about five minutes reading the thread - the shim DLL basically swaps out a public key used by the applications key verification system for a different one so the keygen can create a valid licence key.

Without affecting any integrity checks in the target binary.

doix3• 2 years ago

Ah, that makes sense, thanks! I was pretty confused about the string copy and what that was doing. Normally I'd expect it to be writing a byte array. Now it all makes more sense.

Agingcoder• 2 years ago

Same here - I was interested in the mechanics of the crack, having spent a fair amount of time reverse engineering binaries back in the days.

This is just a bunch of screenshots with ‘lol’ interspersed.

carom• 2 years ago

Agree, this was just a really long thread of someone creating structs in Ida.

fullspectrumdev2• 2 years ago

That’s about 75% of reverse engineering work in IDA or Ghidra, to be fair: labelling/annotating shit, adding types to shit, and making sense of structs and other data types.

There’s extensions to both which automatically try detect such things from common libraries/known calls/etc which massively cuts down on the timesink.

mrguyorama• 2 years ago

I feel like this person is trying to copy Foone's voice but just doesn't get it

archgoon• 2 years ago

'This person' sounds like cts being cts doing cts things. Don't see why you'd think they're copying Foone.

RockRobotRock2• 2 years ago

Cybersec twitter is just awful. Everything has to be a call out or a dunk on someone/some company. It's all so negative.

kaladin-jasnah• 2 years ago

Is this akin to using LD_PRELOAD on Linux to hook something like __libc_start_main and modifying specific data in one of the data sections of the ELF binary or something?

rumdz• 2 years ago

Yes

tamimio2• 2 years ago

Because the whole article can be written in 2 tweets but you need that social media “interaction”, so the author goes on talking about non essential things. The crack itself is simple and smart to bypass the check by changing the public key, the only issue from what I have seen is there’s a lot of hardcoded stuff like the key and the functions numbers, so most likely it won’t work in future updates.

hruzgar• 2 years ago

this is really interesting!

msla• 2 years ago

Threadreader:

https://threadreaderapp.com/thread/1782656618015904103.html?...

Archives:

https://archive.ph/rpFft

https://web.archive.org/web/20240423175847/https://threadrea...

WirelessGigabit• 2 years ago

What is interesting here is that a signed piece of software can pick up an unsigned dll, execute it, and that execution causes a compromise of the system.

speps• 2 years ago

Raymond Chen has a ton of "being on the other side of the airtight hatchway" articles.

Most relevant I found: https://devblogs.microsoft.com/oldnewthing/20200420-00/?p=10...

Probably in this case the installation of the crack requires admin privileges to modify files in "Program Files" folder. Boom, you've broken the rules ;)

saagarjha2• 2 years ago

Turns out that building the airtight hatchway halfway through the crew’s sleeping quarters was a bad decision.

Nextgrid• 2 years ago

This also raises a vulnerability. The author seems convinced this pirated copy is safe because the main binary is signed by Ableton, but there’s no guarantee if there’s a signature check on any of its dependent files (or that the check is not vulnerable or the parsing isn't vulnerable in some way which would allow hijacking the execution flow).

mhh__• 2 years ago

Shared libraries are a scam

can16358p• 2 years ago

Why can't I see the rest but only the first title tweet?

Is that the case or is it a bug?

mimischi• 2 years ago

Twitter requires an account for anything more than a single tweet nowadays. There’s a link with an unrolled thread in the comments here.

lcnPylGDnU4H9OF• 2 years ago

It's been that way for a little while. I presume it's a compromise between requiring a log-in and full "guest" access.

amatecha2• 2 years ago

"as designed", due to the gradual decrease in Twitter's functionality due to unknown reasons (probably trying to manipulate people into signing up to boost user count and ad revenue)

486sx33• 2 years ago

Because AI models kept trying to train on twitter for free.

hermitcrab• 2 years ago

If anyone is interested in crackers and their motivation, you might find this interview interesting: https://successfulsoftware.net/2011/04/07/interview-with-a-c...

tamimio2• 2 years ago

The first software I cracked was in 2004 (some video converter software), the motivation was simply that I can’t afford it, but the “feeling” you get after is like a drug, then it’s more of a challenge knowing that it’s doable no matter what, just like lock picking, then that spark just dies and you stop cracking them.

RetroTechie• 2 years ago

Cracked plenty software back in the day but mostly for personal use.

For the challenge, and because I disliked software being tied to a specific storage medium.

It was a sport to minimize changes. Like pad out a single assembly instruction with NOPs, change a conditional jump into unconditional one, etc.

3abiton• 2 years ago

In the android space, most app cracking is rather easy. Surprisingly.

stong1• 2 years ago

Oh hey, this is my thread. Thanks for reading, yall! <3

I also do reverse engineering streams on YouTube: https://www.youtube.com/basteg0d69

ptsneves2• 2 years ago

A nice topic and insight if not for the way it is written. I could not finish it. It feels the author is unable to articulate his thoughts without interjecting curses and write incoherently. Is this how people communicate technically in the newer generations?

m0zzie• 2 years ago

Is this how people communicate technically in the newer generations?

I suspect this question is in bad faith but I'll answer anyway: this live tweeted thread is more like someone's thought stream, it is not a technical report.

Many humans are capable of both technical writing, free of cursing, and also of dumping a swear-filled thought stream right into their favourite medium - especially when excitedly reverse engineering, or doing anything they're passionate about.

This has been happening for a long time and is not about "the newer generation". You could've found me writing in a similar way on IRC in the late 90s, also talking about reversing.

FWIW your comment feels valid enough up until your final sentence, you just didn't need to attack "the newer generations".

shiroiushi2• 2 years ago

FWIW your comment feels valid enough up until your final sentence, you just didn't need to attack "the newer generations".

Why not? He's exactly right, in my experience. It's definitely been my experience that the newer generations (of Americans) are much more likely to casually use swear words, usually the f-word, in regular conversation, even at work. I hear it all the time with my American colleagues. When I was their age, no one talked like that at work, or really in general except maybe in private with their closest friends.

Another big difference is mass media: when I was their age, American TV did not allow swear words. But in the last 10-20 years, it's completely changed, and it's pretty common to hear the f-word on regular TV. So of course the "newer generations" are going to reflect this in their casual speaking.

ptsneves2• 2 years ago

When I say young generations I don’t mean they are incapable, but that the tools they use and influences they are subject to, are new. This seems to lead to a normalisation of personal communication rituals that are often at odds with previous norms and conciseness.

Courtesy used to be a fallback protocol in society that allowed people of different sensibilities to communicate more efficiently and without personal contexts getting in the way of subject matter. It was also non threatening and the effort put into it was a sign someone was taking the counter part seriously.

axoltl• 2 years ago

Having worked with stong before I can assure you they're perfectly capable of articulating their thoughts when they want to. This is quite a bit more off-the-cuff.

alin233• 2 years ago

It’s done in a similar way on macOS: a dylib is added to the bundle and an LC_LOAD command is added to the app binary. The dylib is the first thing that runs because of using the constructor attribute, like this: https://notes.alinpanaitiu.com/Injecting%20a%20DYLIB%20into%...

The nice thing is that a signed app will refuse to load a dylib that does not have the same signature. So crackers will be forced to change the whole app signature which can be easily detected in app code.

I have that kind of protection in Lunar (https://lunar.fyi/) and Clop (https://lowtechguys.com/clop) and it seems to be good enough as they have no recent cracks.

reactordev• 2 years ago

While code signing and verification is the way, you should also include a step on your own and not rely on the OS to do that for you. Apple’s code signing has been bypassed a few times. Granted they patch it, however one can include a script that enables developer mode in a terminal process that can then disable code signing (enable in-secure apps via developer-mode AppleScript).

It’s impossible to get past inspection on the Apple Store due to that extra script in the app bundle but a downloaded dmg off the web…

alin233• 2 years ago

Yes, I was referring to the fact that I do a manual code sign check in my own code. Otherwise, Gatekeeper will be happy to run any cracker-signed app, they even found ways to staple forged notarization tickets.

Manual code sign checks can only be cracked by patching the binary, which requires a lot more effort than swizzling some methods in a dylib. Or by process injection with Frida, but that requires disabling SIP which most people won’t do just for a cracked app.

int3• 2 years ago

seems like crackers could just patch the app code that detects this, no?

alin233• 2 years ago

For sure, it’s just a bit more effort to reverse the app binary and find that part of the code. Enough effort to deter most crackers apparently.

xyst• 2 years ago

... it seems to be good enough as they have no recent cracks.

challenge accepted

eps• 2 years ago

Yeah, the GP should've not said that.

bobmcnamara• 2 years ago

Sometimes fixing integrity checks can be as simple as replacing the failure case with nops :)

doix3• 2 years ago

This is different though, because it's modifying the executable to load the new lib, right?

If you're modifying the executable anyway, why not just patch it directly instead of going through these hoops?

The equivalent on Linux would be setting LD_PRELOAD and putting your .so file there. A quick Google search seems to imply that the OSX equivalent is DYLD_INSERT_LIBRARIES but I have no idea how similar they are.

cedws• 2 years ago

Very interesting. I really should get back into RE.

Selfish question for a project of my own: is there any way to magically gain early code execution in a process on Windows other than a shim DLL? I'm too lazy to write one to pass through the all exports (reflective shim DLL possible...?)

chc4• 2 years ago

CreateProcess the victim with CREATE_SUSPENDED, do whatever code patching, then ResumeThread it. Pretty sure you can even CreateRemoteThread into the victim for DLL injection, since it just suspends the primary thread, and then patch "yourself" in DllMain instead of having to do remote memory calls.

reeeeaway• 2 years ago

Alternatively, give frida a go. It handles all the hard parts for you magically and then you get to instrument the binary with Javascript :) mixing dynamic and static techniques is really powerful

smolsky• 2 years ago

Nice!

P.S. who remembers the legendary Phrozen Crew cracks? They were minimal byte patches that often toggled a conditional jump in an MS-DOS app/game...

brcmthrowaway4• 2 years ago

Razor1991 is the GOAT crew

Ylpertnodi• 2 years ago

The "Mike Hunt" Cubase for atari hack.

brcmthrowaway4• 2 years ago

Stop this at once. Ableton folks are gonna go hungry

pests• 2 years ago

All the swearing turned me off. I don't mind cussing and use them myself, but does every tweet need to drop the f bomb?

tucnak• 2 years ago

Yes, it does

silisili• 2 years ago

Same, I'm far from a prude, but time and place. And reading about reverse engineering is neither.

It reminds me of a really smart kid who doesn't want to be seen as a nerd, so writes nonchalantly and injects vulgarities into an otherwise brilliant project. Good Will Hunting vibes.

It's not really offensive, it's just distracting.

brcmthrowaway4• 2 years ago

you just described 99% of anime avatar twitter

lionkor• 2 years ago

I found this pretty insufferable to read, and in good X fashion, the second comment from the top is "we should teach llama3 to do this stuff!".

Thanks for sharing, it was interesting, but wow that's a bad format and bad writing.

redbell• 2 years ago

Pretty interesting!

I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks comes down to understanding the basics of how these systems are designed to work in the first place. Add to this, the possession of the right toolbox to do the job.

Back in 2010, I took on the challenge of cracking paid/licensed POS software. I am, in no way, a cracker or hacker, but once I understood how this app works, I followed a simple logic based on these rules:

  a. The app had a trial version with a number of *runs* set, and with each launch of the app, the number will decrease by one. It was set to around 100, I believe.
  b. The app runs on a LAN, on multiple computers, with one being the server. To my surprise, there were no IP configurations, and it turned out that it worked on LAN by setting the app directory as a *shared folder* in Windows!!
  c. On each app launch, even from other computers (having access to the shared folder), the count will decrease.

So, I started my investigation:

  1. Since you have a shared folder, based on (c) above, I assumed the location where the count number is stored *must be inside* this shared folder, not in the Windows registry or other places.
  2. I launched the app, wrote down the current count, and closed it.
  3. I searched inside this shared folder for *.* (all files), then sorted them by last edited.
  4. I picked the first one from the search result as it was the only one with the same time as *now*; it was in a binary format.
  5. I opened it using a hex editor, converted (using calc.exe) to HEX the count I wrote down on (2), searched for it, and found it. I identified its position.
  6. I closed the hex editor, repeated (2),(3) and (4), and got the same results.
  7. Now, I typed 999 in calc.exe and converted it to HEX, and in the open HEX editor, I edited the count at its current position with the new value, saved, and closed the binary file.
  8. Restarted the POS app, went to about, and.. booooom , it now thinks that you have 999 days remaining :)

Although I never used this Point of Sale software, it was an exciting achievement for me. I felt like a real hacker.

shiroiushi2• 2 years ago

You were a real hacker. That's exactly how a real hacker would have done it, starting from the simplest method of reverse-engineering, and moving to more difficult methods or complicated tools only as necessary. Luckily for you, this POS app wasn't very well-designed from a security standpoint, but that's not unusual, especially for software that has a very limited market and is written by a very small team.

skeaker• 2 years ago

Similar story from me, I was digging around in the code of this game that I had been playing since I wanted to make mods for it. At one point I found the internal IDs for different outfits you can put on your characters which was relevant to what I was making, so I grepped for those IDs since they were one of the few strings that weren't jumbled by code obfuscation. Stumbled upon the code that checks if you own the DLC outfits and found out you could basically just swap the check for a return(true). You could even use them online... Hardly any protection at all but it hadn't been cracked simply because nobody else looked that closely.

NoahKAndrews• 2 years ago

Files are allowed to not have extensions. Wouldn't just * been enough?

lossolo• 2 years ago

"downloaded torrent is a split rar. lol

in 2024"

That doesn't have anything to do with being old fashioned. It's about how racing works in scene FTPs. When you release something race begins starting from so called affil "sites" (group release to all their affil sites at the same time) from there it propagates to whole scene by couriers. Because of how FTP works you need to split the file into multiple files so it can be uploaded by multiple people from multiple sources making distribution fast. And rar is used for that, there are scene rules for it and it's not using compression option.

pimlottc• 2 years ago

From the 2021 scene release rules for games (ISO rips) [0]:

1.7 The ISO file has to be packed into a RAR archive using the RAR4 or the RAR5 format and the old style volume naming scheme. e.g. grp-gamename.rar, grp-gamename.r00, grp-gamename.r01, ...

0: https://scenerules.org/html/2021_GAMEiSO.html

brcmthrowaway4• 2 years ago

You know too much not to be a scene member

SSLy• 2 years ago

It's all public knowledge by now.

Reverse engineering a software crack

Related Stories