How To Crack Winzip Using Ollydbg

카테고리 없음

by canamconszo1971 2020. 3. 5. 15:31

How To Crack Winzip Using Ollydbg Download
How To Crack Software Using X64dbg
Winzip Free Download

Hey guys,Today I’ll be showing you how to crack WinRAR. I was storing some files on my webserver and my WinRAR license was past its due date (like a really long time) and the nag screen annoyed me as fuck. That’s why I decided to reverse engineer it and write a tutorial upon it.ow if you are on 32bit you can use OllyDBG, if you are on 64bit you need to use another debugger.The reason different architectures (32/64bit) requires different debuggers is because of the distribution of our target.

WinRAR has a 32 and 64 bit installer, whereas the previous target (Internet Downloader Manager) only has a 32 bit installer. Now 32 bit applications runs fine on 64 bit but not vice versa. Olly can’t handle 64 bit applications and if you try to load the 64 bit WinRAR to Olly it will probably notice you about how it couldn’t load the file.I’ll be using x64dbg, but if you are on 32 bit and you are using Olly the steps shouldn’t differ that much (the debuggers are very look a like).First, we start again by analyzing the target, I don’t really want to activate it as that would probably take a lot longer and besides, I just want to get rid of the nag screen.I couldn’t find any register form, just some buttons that led me to the purchase page.

So, I fired up Google and started looking for license keys and I found out that if you purchase a key, you will get a file named ‘rarkey.key’ or ‘rarreg.txt’. This tells us the target hash multiple license formats, which we can and will exploit.

Lets take ‘rarkey.key’.Attach your debugger to the WinRAR process and make sure you are in the winrar.exe module.Right click - Search For - String References. This will pop up a list of all occuring strings in the WinRAR.exe module.To move on, lets search for ‘rarkey’, these are my results (yours should be the same except for the addresses):Lets check them all. One leads to:This looks like the function is trying to find any of the allowed file formats. Nothing we can use. Lets take a look at the next one:Oh! That looks alright, it seems like call 13F136D20 is the method to parse the license key, meaning that the JE 13F197D3B afterwards will decide whether the license is valid or not, interesting. Note that the JE instruction jumps over a call, which could be the function where the nagscreen is located: call 13F169968.

How To Crack Winzip Using Ollydbg Download

Although we have 2 more strings to check, so lets continue.You might already have seen due the bytes between the last 2 addresses are minimal that they are really close to eachother:If tried figuring out what that function is used for, but I noticed it isn’t executed at all. It could be some testing code or just there to brainfuck reversers but as long as the code won’t get executed we can leave it there and have no worries about it.Okay, lets get back to our only useful find:If you put a breakpoint on there and resume (F9) the program, you notice that the breakpoint is actually getting hit within a second. This usually means the function we are in is inside a thread, which matches the behaviour of the nag screen.

Lets follow the code (step over, f8):As you can see, the jump (JE) wasn’t hit and we are going to execute the function located at 0x13F169968. Make sure you stand on the call instruction (like in the screenshot, the address on the left side is black at the call instruction, this means that is where we are currently). Then, press F7 to step inside the call function. Step over some more instructions and you will see a few JE’s.The second JE jumps all the way down to the function. If you put a breakpoint on the first JE and run the program again (F9) you will notice it keeps getting hit. Whenever it hits the breakpoint and you hit F9 again, it will instantly hit the breakpoint again.

It means we are still in the thread. I noticed after putting the breakpoint that 9/10 times it takes the second JE to the end of the method. If you have used WinRAR for awhile you know that the nag screen appears randomly, so my guess would be this is the right method. Also, when you look through the method you will see strings like ‘reminder’ and you will see the link that is on the nag screen.To test out whether we have the right method, you can change the 2nd instruction its opcode from (JE) to JNE. Now whenever you resume the program and get past the breakpoint a nag screen will appear! If you want it to stop (it will keep opening a nag screen every second) change it back to JE.The patch is fairly simple, if its JNZ it will always show the nag screen unless it actually should shows us the nag screen (the 1/10 times) screen.

If its JE it will only show the nag screen sometimes, but still enough for it to annoy the fuck out of us. But we don’t want to see it 9/10 or 1/10 times, we don’t want to see it at all. Meaning we have to change (don’t do it yet!) JE to JMP.

How To Crack Software Using X64dbg

JMP (jump) means that it will always take the jump, no matter what and that means we will never have to see the nag again:).If you inspected the first JE you would notice that it jumps past the second JE. Hmm, that’s unexpected behavior as that would skip our patch.

Again, the solution to this is also very simple:The original code (don’t copy these as yours are different):Code. 000AC 74 09 jmp winrar.13F169E29 Edit - Copy to executable -. new window opens.

Right click - Save FileSaving in x64dbg: Right click - Patches - (make sure all patches are selected) - Patch FileMake sure that after you have saved the file you replace the original WinRAR.exe with your patched version.,.