Bypassing Protections: Reversing and Recreating a Protected DLL

Hello and welcome to this new series called Bypassing Protections. Together, we will learn some new methods to bypass protections which have certain flaws in their implementation. In this example, we will look at an dll which is protected with asprotect and use a simple method to recreate it. Since this protected dll only performs license check procedures, it is very easy for us to recreate the dll in Delphi, bypassing the protection all together. In some applications, the authors like to place all of the license management code into a single dll which all modules of the application reference to determine if the it is registered. Since this handles all license management, this becomes the Achilles heel in the application. Together, we will reverse engineer this small dll and recreate all of the functions and procedures in delphi so that they always return that correct values. Due to legal purposes, I will not mention the name of this application in the article, but will include pictures that will clearly help you determine which application this tutorial is based upon.

Let's download the application. When you run it, you are met with this screen. Probing through the directory with protectionID, you will soon discover that the dll named ba8pro is protected with ASProtect. Let's view the export table of ba8pro in PETools and see what functions and procedures it contains.

As we can see, this only contains 4 procedures. If we check the main executable, we see that there are no import references to this dll and that on startup, this dll is not in memory. That means that it likely loads this dll using the LoadLibrary function and obtains the procedure VA using GetProcAddress. Since this is the case, we can find where these procedures are called by simply searching for string references of the function names. When we load the main executable in ollydbg, we can already see the ba8pro dll referenced in the main procedure. Below that we can see references to CheckVersion and CheckDays.

After we step to the point which I labeled Call To CheckVersion, we notice nothing is pushed onto the stack before we call this function. Therefore, we can conclude that the CheckVersion function does not take parameters. After this procedure, we return the value of $FFFFFFFF to EAX and store it at 5D9B04. Since we move the full EAX register to this value, we can conclude that CheckVersion Return an Integer. After playing around, I discovered that if we return a 0 from CheckVersion, it will run as registered. Therefore, we can recreate this dll function in Delphi like this:

Function CheckVersion(): Integer; stdcall;
Begin
Result:=0; //pro
End;

The next function CheckDays works the same way. It does not take parameters and returns the number of days as an integer. We can declare it like this:

Function CheckDays():Integer;  stdcall;
Begin
 Result:=255; //Any value greater than 0 and <= $7FFFFFFF will work
End;

Next, we will look at the function GetModeVersion. After a quick string search for GetModeVersion, we should arrive here:

Let's toggle a breakpoint here, run the application, go to help, and click the about button. This will cause ollydbg to break here. Once we step down to the call, we realize that a value is pushed onto the stack prior to entering this call. Take note of the value. Let's step into this routine to get a better idea of what is going on.

After stepping to the end of the procedure, we discover that the value pushed onto the stack is a pointer to a Unicode string value which gets populated with the registration information string which will appear on the about form. This routine does not return a value to EAX, so we can conclude that this is a procedure. After playing around with this procedure, I found that it will return the following string if registered: Registered Version /n Single User License /n Lifetime Free Upgrades We can recreate this Procedure to return this string like this:

Procedure GetModeVersion(s:pWideString); stdcall;
Begin
s^:='Registered Version'+#13+'Single User License'+#13+'Lifetime Free Upgrades'; //Write to the String.
End;

Finally, we will look at the final function RegisterApplication. Since we are making this registered by default, this function we not be used, but we will add this anyway to complete the dll. Let's restart the application. After a quick string search, we can find the call to RegisterApplication.

Let's run the application and enter some random registration details.

As we can see, this is passing two strings to the function. When we return from this routine, we see that al is populated with a 0. Since the next function tests whether or not al is equal to 0, we can determine that al is a boolean where 0=false and 1=true. That means that the RegisterApplication function takes two constant(unchanging) strings as parameters and returns a boolean. We can recreate this function like this:

Function RegisterApplication(CONST s,s2:string):Boolean; stdcall;
Begin
Result:=true;
End;

Now that we have recreated these functions, our finished code will look like this:

The only thing left to do is to replace the dll in the directory with the one that we created, patch the integrity checks in the modules(not shown for legal purposes), and add a fake key in the registry(not shown for legal purposes).

Now that we have done this, we will discuss some ways for the author to improve this protection. Since this dll contains only licensing information, it makes it easy for us to duplicate. However, if the company were to add some core application functions along side of these license check routines, it would make recreating the dll much more difficult. They could also protect each individual module with asprotect to make it necessary for us to unpack each file in order to bypass/patch the integrity checks.

With that said, I hope you enjoyed the tutorial. Feel free to ask any questions you have below. Until next time, happy reversing.

Customizable aspr_ide.dll With Source Code

Sometimes, after unpacking an asprotect target, the application may still rely on the functions and procedures provided by asprotect in its aspr_ide.dll. While the sdk allows for custom functions to be added to it, the generic functions include  CheckKeyAndDecrypt, SetUserKey, GetHardwareID, GetTrialExecs, GetExpirationDate, GetRegistrationKeys, CheckKey, GetModeInformation, GetRegistrationInformation, GetTrialDays, GetKeyDate, and GetKeyExpirationDate. The aspr_ide.dll and its source code provided below simulate all of these functions and return the correct values to register the application. Using the delphi source code, you can modify it to fit the requirements of your target.

aspr_ide.dll Download:

https://mega.nz/#!pgdxCR4D!Ll9VYFHi1xuOgwBBvwCq9z3oyyjRdsjzQ4PH9gFqIqE

Source Code Download:

https://mega.nz/#!ktt3xbBT!8SObKMQe1KUy56fn8WWndIPVZBhcD9o9K1Xlekyy9Uo

Delphi Tips: Hashing a String With Delphi Encryption Compendium(DEC)

Today, I wanted to use the Delphi Encryption Compendium(DEC) to hash a string. It is a little bit difficult to figure out how to use the components since they are poorly documented, but after a few minutes, I came up with this. At first, I tried to use the CalcBinary function, which allows you pass a string to it. It worked fine, but it is limited due to the fact that it would cast all input strings as an ansistring type. As a result, I switched to the CalcStream type to overcome this limitation. Here are two functions which you can use to calculate an MD5 hash for either a UnicodeString or AnsiString. These functions can be easily converted to a different hash type simply by changing the declaration and create type. The available hash types are: 
THash_MD2, THash_MD4, THash_MD5, THash_RipeMD128, THash_RipeMD160, THash_RipeMD256, THash_RipeMD320, THash_SHA, THash_SHA1, THash_SHA256, THash_SHA384, THash_SHA512, THash_Haval128, THash_Haval160, THash_Haval192, THash_Haval224, THash_Haval256, Thash_Tiger, THash_Panama, THash_Whirlpool, THash_Whirlpool1, THash_Square, THash_Snefru128, THash_Snefru256, and THash_Sapphire. 
You can specify haval rounds like this: hash.rounds:=3; //(3,4,and 5 are valid round types.)

Uses DECHash, DECFmt; 

Function GetMD5_Unicode(input: UnicodeString):String;
var
val: tStringStream;
hash: tHash_MD5;
len: int64;
Begin
val:=tStringStream.Create;
len:=length(input)*2;
val.Write(input[1], len);
val.Seek(0, soFromBeginning);
hash:=tHash_MD5.Create();
result:=string(hash.CalcStream(val, len, TFormat_HEX));
hash.Free;
val.Free;
End;

Function GetMD5_Ansi(input: AnsiString):String;
var
val: tStringStream;
hash: tHash_MD5;
len: int64;
Begin
val:=tStringStream.Create;
len:=length(input);
val.Write(input[1] ,len);
val.Seek(0, soFromBeginning);
hash:=tHash_MD5.Create();
result:=string(hash.CalcStream(val, len, TFormat_HEX));
hash.Free;
val.Free;
End;

The Delphi Encryption Compendium(DEC) can be downloaded here:
https://github.com/winkelsdorf/DelphiEncryptionCompendium/releases
 
Until next time, happy programming and reversing. :)

Random Serial Generator 1.0

Random Serial Generator 1.0 is a simple application that allows you to generate a random serial number for testing license algorithms or implementing them into your own application.

Features:
1. Predefined Character Sets: A-Z, a-z, 0-9, 0-F, 0-f, 0-9 + A-Z, 0-9 + a-z, and 0-9, A-Z, + a-z.
2. Define a Custom Character Set.
3. Input length in either Decimal or Hexadecimal format.
4. Insert Dashes in Insert or Replace Mode.

I did not add any size limits on the input length, so use large numbers with caution. 

VirusTotal Scan (100% Clean):
https://www.virustotal.com/en/file/eb970e0cd75d0324f9ef3b81ad1198377e08ac82b3f51f0222183dc8d6815ac3/analysis/1432434294/

Download:

https://mega.co.nz/#!x18TRabY!9eKZ4H7FyJ8Lt6xz9uBj8s2yZwEZy55AbLvuqtyrT98

Source Code:
https://mega.co.nz/#!c1UwVYQZ!VQVLdrfRDfnDnOB7_DHtXPNjlAKgEobxXbpN7mFEkSk

This software is 100% free and open source. It comes with no warranty.

Icon borrowed from: http://www.iconarchive.com/show/aeon-icons-by-kyo-tux/Sign-LogOff-icon.html

Hashing Utility Extended 1.0

Hashing Utility Extended 1.0 is an extended version of Hashing Utility 2.0 which supports 77 types of character encoding sets and 14 types of hash encoding schemes.

Supported hash algorithms:
SHA1
SHA256
SHA384
SHA512
MD2
MD4
MD5
HAVAL(ALL)
RIPEMD128
RIPEMD160
RIPEMD256
RIPEMD320

Supported String Encoding:
ANSI
US-ASCII
UNICODE
UNICODEFFFE
ISO-8859-1
ISO-8859-2
ISO-8859-3
ISO-8859-4
ISO-8859-5
ISO-8859-6
ISO-8859-7
ISO-8859-8
ISO-8859-9
ISO-8859-13
ISO-8859-15
WINDOWS-874
WINDOWS-1250
WINDOWS-1251
WINDOWS-1252
WINDOWS-1253
WINDOWS-1254
WINDOWS-1255
WINDOWS-1256
WINDOWS-1257
WINDOWS-1258
UTF-7
UTF-8
UTF-32
UTF-32BE
SHIFT_JIS
GB2312
KS_C_5601-1987
BIG5
ISO-2022-JP
ISO-2022-KR
EUC-JP
EUC-KR
MACINTOSH
X-MAC-JAPANESE
X-MAC-CHINESETRAD
X-MAC-KOREAN
X-MAC-ARABIC
X-MAC-HEBREW
X-MAC-GREEK
X-MAC-CYRILLIC
X-MAC-CHINESESIMP
X-MAC-ROMANIAN
X-MAC-UKRAINIAN
X-MAC-THAI
X-MAC-CE
X-MAC-ICELANDIC
X-MAC-TURKISH
X-MAC-CROATIAN
ASMO-708
DOS-720
DOS-862
IBM037
IBM437
IBM500
IBM737
IBM775
IBM850
IBM852
IBM855
IBM857
IBM00858
IBM860
IBM861
IBM863
IBM864
IBM865
CP866
IBM869
IBM870
CP875
KOI8-R
KOI8-U

Supported Hash Encoding:
HEX
BASE64
MODBASE64
BASE32
BASE58
UU
QP
URL
Q
B
URL_OAUTH
URL_RFC1738
URL_RFC2396
URL_RFC3986

Download:
https://mega.co.nz/#!ogcy3a4T!0D5SAMZ5mdeBJkTYYr7-GTivPMS77MRcWUL-HWE8g3s

Source:
https://mega.co.nz/#!ooUE0JQT!_peZ4Qw-C_xa42D8uuDalPsH-47FmunyMw8tus0_Wpg

This software uses the Chilkat Delphi Libraries:
http://www.chilkatsoft.com/delphiDll.asp

Keygenning With Delphi: Useful Delphi Functions and Tips

Hello and welcome to this short tutorial for keygenning in Delphi. A lot of beginners who are trying to learn keygenning often get stuck with questions about how to implement certain things or manipulate strings or characters in certain ways. In this tutorial, I will try to cover many of the things that were confusing to me and give you some tips on how to accomplish some of these tasks in a simple and effective manner.

Question 1: How do I get the numerical value of a character and a character value of a number?

A lot of licensing algorithms like to manipulate the numerical value of each character in a name individually in a mathematical operation. In order to do this in delphi, we can use the ord() function. Ord is short for ordinal. When a character is passed to this function, it will return the numerical value of the character. In this case we can implement myByte:=ord('A'); This sets myByte to 65 or $41 in hex. If you want to loop through an entire string and add all of the characters together we can do this:

var
I: Byte;
math: integer;
name: String;
Begin
name:='George';
math:=0;

For I := 1 to length(name) do
math:=math+ord(name[I]);

End;

In this example, we loop through the entire string and use 'name[I]' to get the character of the name at the current loop value. In Delphi, the first character is always character '1' unlike C++ where the first character is '0';
In order to get a character value of a number, we will use the chr() function. This allows us to pass a byte value to the function and get the character representation of it. If we execute myChar:=chr($41); this will set myChar = 'A'; Here is a code example.

CONST myVals: Array[0..3] of byte=($41,$42,$43,$44);
VAR
myStr: String;
I:byte;
Begin
myStr:=''; //Clears the Strings

for I := 0 to 3 do
myStr:=myStr+chr(myVals[I]); //Loops through myVals and converts the bytes to characters.
End; //In the end, myStr='ABCD'

Question 2: How do I work with hexadecimal values? How do I convert HexToInt? How do I convert an integer to a hex string?

Working with hexadecimal values in delphi is quite simple once you know how to do it. You are able to easily embed hexadecimal values in your code by simply adding a '$' sign before the value. With that said I:=$51; would be a simple way to put a hex numerical value in your code without having to convert it to decimal. If you are working with a hex string and you want to convert it to an integer, it is quite simple. The built-in delphi function strToInt can do it if you tell it that the string is a hex value. If you have the hex string value
of '5A223B4A', to convert it to hex, all you need to do is place a '$' at the beginning and pass it to the strToInt function. The '$' informs the function that this is a hex value. Therefore, the code I:=strToInt('$'+'5A223B4A') will convert the hex string to a numerical/integer value. If you have to do this with multiple values, you can simply create a small function such as this:

function hexToInt(hexStr: string): Integer;
begin
Result:=strToInt('$'; + hexStr);
end;
To convert an integer to a hex string, we need to use the built in intToHex function. This function takes two parameters. The first value is our numerical value or variable while the second is the length format. The length format tells the function what the minimum length you want the string to return. For example, if you wanted the length of the hex value to always be 8 or the equivalent of a 32 bit hex value, we will add a parameter of 8. This means that if the converted value is less than 8 characters, it will pad the value with zeros to get the desired length. However, if the converted value is greater than the length value, it will still output the correct value. That is because the length parameter only sets the minimum length, not the maximum. Therefore, if your code is intToHex($ffffffff, 4), it will output 'FFFFFFFF' where intToHex($ff, 4) will output '00FF'. Note that this function always returns uppercase hex strings.

Question 3: How do I generate a random letter/character from A-Z or a random hex value?

To generate a random letter or character between A-Z or a-z, we can do this numerically using the random function without needing to embed all 26 characters as a string. The characters A-Z have the numerical values of $41 to $5A while a-z have the numerical values of $61 to $7A. To generate a random uppercase character, we can do this:

VAR
myChar, myHexChar: Char;

Begin
myChar:= chr(byte(random(26)+$41)); //This generates a random Uppercase letter.
myChar:= chr(byte(random(26)+$61)); //This generates a random Lowercase letter.


For a random hex character, we can simply do this:

myHexChar:= intToHex(random($10), 1);//Creates a single hex character from '0-F'.
End;

Question 4: How do I work with Unicode String bytes?

Working with each each individual byte of a unicode string can be a little tricky in delphi, but can be accomplished with the use of pointers. In this code, we will create a byte pointer to our unicode string and use that pointer to read each byte individually. Since a unicode string represents each character with 2 bytes, we will need to get the length of our string and multiply it by 2 in order to get the length of the bytes. It this example, we will convert a unicode string to hex, byte by byte.

var
i,i2:integer;
pntr:pointer;
str2:string;
strU:unicodeString;
begin

str2:='';
strU:='ABCDEFG';
pntr:=(@strU[1]); //This creates a pointer to our string.
   
I2:=length(strU)*2;//doubles the length to equal the length of its bytes.
for I := 1 to I2 do begin
str2:=str2+inttohex(byte(pntr^),2); //This tells delphi to read the byte at the address of which our pointer points to. In this case, it is the address of our string.

inc(pbyte(pntr),1); // This will increment our pointer address to go to the next value in our string.
end;//End loop

In the end, str2 will equal '4100420043004400450046004700'.

Question 5: How do I manipulate or obtain the individual bytes in an integer or cardinal?

As you may know, an integer value consists of 4 bytes. Some mathematical operations require us to manipulate an individual byte from this or extract it. Here are a few operations you can use to get the data you need.
If you are looking to access an individual byte other than the first, it is easiest to use the SHR function to move the bytes to the one that you need. The SHR function works at a binary level. A byte consists of 8 binary digits. In order to get to the next byte in the value, you would need to SHR by 8. Here are some examples of how to do so. We will use the hex value AABBCCDD to show you how to obtain each portion as a byte.

VAR
MyHex: Integer;
MyByte: Byte;
Begin
 myHex:=$AABBCCDD;

//let's get the $CC portion.
MyByte:=Byte(myHex SHR 8);// this moves the integer over by 8 binary digits and discards them from the right.
//In memory $AABBCCDD becomes $00AABBCC after the shift.


//let's get the $BB portion.
MyByte:=Byte(myHex SHR 16);// this moves the integer over by 16 binary digits and discards them.
//In memory $AABBCCDD becomes $0000AABB after the shift.
//let's get the $BB portion.
MyByte:=Byte(myHex SHR 24);// this moves the integer over by 24 binary digits and discards them.
//In memory $AABBCCDD becomes $000000AA after the shift.


In this next example, lets pretend we need to convert a value such as AABBCCDD to AA000000. While we could accomplish this with 2 shifts, it is easiest to use the and instruction. By doing $AABBCCDD and $FF000000, the result. The location of the F hex values will be the only portions remaining in the integer where the 0 values will be eliminated. Here are a few examples.

Var
int1,int2:Integer;
Begin
int1:=$AABBCCDD;
Int2:=int1 and $f0f0f0f0; //Int2=$A0B0C0D0
Int2:=int1 and $ff00;       //Int2=$0000CC00
End;

Question 6: How do I convert a float to hexadecimal?

 A very easy way to get the hexadecimal value of a float is to create a pointer to it and read it as a int64 value and use the format command to convert it to hexadecimal. Here is the approach I use:

VAR
flt: double;
I64: int64;
s:string;
Begin
flt:=12.45443563350
I64:=PInt64(@f1)^; //We get the address and read the value it contains as a int64 value.
s:=Format('%X', [I64]);//converts int64 to hex string;


This concludes this short entry on keygenning with delphi. If you have questions you would like to have answered, post them below and I will try to include them in my next tutorial. Until next time, happy reversing.