Aescu

1) Keygen
2) Usefull breackpoints

KeyGens ...
Useful tips:
1. The best tool to analyze a key file is an Hex Editor. Text editor are not su
itable for this task.
2. A key file is nothing more than a continuous array of bytes inside a small f
ile. These bytes reflect the personal user
information (encrypted), checksums of the key file integrity, encrypted dates,
names, addresses, encrypted flags (for instance: a flag for multi-user license),
etc.
3. To defeat a Key File Based protection scheme, you should create a little pro
gram to code a small bogus key file. This
generic program should be able to create files under different names a sizes. Th
e content of this bogus file (against most
believes) must be readable information. In my
case, the bogus key file generator, cuts a large chapter from my favorite litera
ture novel and paste it in the bogus file, adjusting
the file size and name according to my necessities. Why readable information ins
ide the bogus file? because the target program
will read strategic offset locations of the key file. A readable text inside it
will warn about the precise location being read at any
time. It will also mark the locations where certain checksums must be added to t
he final key file.
4. The key file name is in most cases, the target program main executable file
name with the extension '*.key'. A very old
stupidity flag still available these days. Other strategies to figure out the ke
y file name, are the use of a string searching utility,
reading the user's manual (sometimes the author will include instructions on the
key file installation, revealing its name), at
debugging level, bpint 21 if ah==3d (DOS), when the break occurs, execute: d (e)
dx at SoftICE command screen, in windows
environment, bpx CreatFile, ReadFile, GetFileAttributesA, etc., will perform the
same task.
Once you have figured out the key file name, create the bogus file and copy it t
o the same path as the main target executable.
Start the program and see what happens. If you receive an 'Invalid Key File' or
'Corrupted Key File' message (another
stupidity flag), your cracking work have been greatly reduced; the next logical
step is to search the location of the code where
this message is triggered.
5. The key file has to be read. There is no other alternative, the program must
read the key file to test its validity. According to
this, appropriate breakpoints on file reading interrupts (DOS) or API's (windows
) should be set.
SoftICE Advice: Useful Breakpoints ...
One of the most important abilities a cracker most develop is where, when and wh
at kind of breakpoint to set. If a perfectly
timed and intelligent breakpoint is not set, then you'll grow old and die before
being able to take a glimpse of the protection
scheme. Remember, even the most insignificant program can contain thousands of c
ode lines. The most important breakpoints
you should know are:
General Purposes ...
bpx messagebox
bpx getdlgitemtext
bpx getwindowtext
bpx hmemcpy
bpx showwindow
bpx updatewindow
bmsg xxxx wm_gettext
bmsg xxxx wm_command
bmsg xxxx wm_move
Time Related ...
bpint 21 if ah==2A (DOS)
bpx getlocaltime
bpx getfiletime
bpx getsystemtime
Register Flag Related (e.g. Flag on EAX) ...
bpx cs:eip if EAX==0 (SICE 3.x)
Memory Flag Related (e.g. Flag on 0030:000045AA) ...
bpmb cs:eip rw if 0x30:0x45AA==0 (SICE 3.x)
"Hear The Echo" Technique Related ...
bpx 0x30:0x45AA do "d 0x30:0x44BB" (SICE 3.x)
bpx CS:0x66CC do "? EAX" (SICE 3.x)
CD-ROM and Disk Based Schemes ...
bpint 13 if ah==2 (DOS)
bpint 13 if ah==3 (DOS)
bpint 13 if ah==4 (DOS)
bpx GetFileAttributesA
bpx GetFileSize
bpx GetDriveType
bpx GetLastError
bpx ReadFile
bpio -h (Your CD-ROM Port Address) R
Dongle Cracking ...
bpio -h 278 R
bpio -h 378 R
Key File Related ...
bpint 21 if ah==3dh (DOS)
bpint 31 if ah==3fh (DOS)
bpint 21 if ah==3dh (DOS)
bpx ReadFileA
bpx CreateFileA
Keyboard Input Related ...
bpint 16 if ah==0 (DOS)
bpint 21 if ah==0xA (DOS)
Possibilities are endless. I copied only those breakpoints which are considered
most useful and frequently used for crackers,
nevertheless, if you have a preferred breakpoint to crack certain schemes that i
s not listed, please let me know, I'll publish it (if
worthy).