Teach you how to crack WinRAR4.01

WinRAR is one of the most commonly used software. Since it is not a free software, after the trial period, every time you open winRAR, you will be prompted to register a dialog box, which is annoying. Therefore, my general practice is to download a lower version of winrar after it is cracked (the latest version of WinRAR is often slow to crack), so if you want to taste it, you have to wait for a while.
I recently read "hacker disassembly and decryption (version 2)", which introduces the basic method for cracking WinRAR. However, the old version mentioned in the book is WINRAR3.42. Based on the methods described in this article and my own understanding, I have cracked the latest WinRAR version 4.01, and did not dare to exclusive. The special record cracking method is used to notify readers.

Required tools
1. IDAPro
At present, the best static Disassembly tool is essential for hackers, but it is a pity that it is a paid software. Of course, it is also cracked, that is, the version is relatively low. I am using the latest version of the trial version. Oh, there are all basic skills, so we can use it together.

2. HIEW
The famous hexadecimal editing tool is small but powerful. It also supports disassembly and display of files and can be used directly to modify the original file in assembly language, which is very convenient.

3. Kerberos API
An API tracing tool that records all API functions called during software running and helps us quickly locate key points of the program.

Attack Method

First download WINRAR4.01 from the Huawei Software Park. After installation, adjust the current system time to 40 days later. After WinRAR is installed, it can be used for free for 40 days. After the trial period, the purchase dialog box will pop up. This dialog box is a breakthrough.
We hope to use the probe test function of Kerberos API to find the system API that pops up the purchase dialog box. There are many APIs related to the dialog box, such as CreateDialog, DialogBox, and MessageBox. Which function is used by WinRAR developers? The Kerberos API detector is needed for clarity.
Before using the Kerberos API probe, configure the filter option so that it can discard API calls that do not provide useful information. Open the ke_spy.txt file and comment out the following functions: TlsGetValue, DefWindowProcA, DispatchMessageA, GetFocus, GetMessageA, SendMessageA, SendMessageW, TranslateAcceleratorA, expires, and TranslateMessage. Insert a semicolon (;) before the function name to comment out a function. To improve filtering performance, click the "Option" button and set the "Report only. exe calls( .exe )" check box. This example only collects api calls from winrar.exe, rather than calls from the loaded dll. It should be noted that, if this is not done, no errors will occur. However, if this is not done, the size of the report file will be large and difficult to analyze.
 
Now, click the "Browse" button to specify the WinRAR file path, and then click the "Inject (injection)" button. The window is displayed.

 

 

 
Haha, after being injected into WinRAR with Kerberos, a bare window appears in front of us. Don't think there is any error at this time. Just wait patiently for 2-3 seconds and close WinRAR, and enable winrar. rep file, which is saved in the installation directory of WinRAR.
The most convenient way to test the report file is to start from the end of the file. This is because the user registration pop-up window will display the last one after the interface is initialized. Therefore, you can easily find the call to the DialogBoxParamW function, which displays the "REMINDER" dialog box. It is the function used to create a pop-up window for user registration.
Is the part of the report file generated by the Kerberos API prophtor.

The Kerberos API probe even displays the address -------- 00498F27 returned from the function, which can immediately direct hackers to the protection code. View this code in the anti-assembler. Start the IDA pro, winrar.exe file, press "G" (jump to an address), specify the return address (00498F27), and press "Enter. As shown in:

 
You can see the call of the DialogBoxParamW function, on which the disassembly code is shown below:
. Text: 00498E95 cmp dword_4EA434, 0; jumptable 00498E21 case 2
. Text: 00498E9C jnz loc_498F27
. Text: 00498EA2 push 400 h
. Text: 00498EA7 lea eax, [esp + 0BB0h + WideCharStr]
. Text: 00498logy push eax
. Text: 00498EAF mov ecx, offset unk_4F0DD0
. Text: 00498EB4 call sub_4130A0
. Text: 00498EB9 cmp byte_5150F8, 0
. Text: 00498EC0 jnz short loc_498F27
. Text: 00498EC2 cmp byte_4D446F, 0
. Text: 00498EC9 jnz short loc_498F27
. Text: 00498ECB cmp byte_4D70A0, 0
. Text: 00498ED2 jnz short loc_498F27
. Text: 00498ED4 push 6; int
. Text: 00498ED6 push offset aRarkey; "rarkey"
. Text: 00498EDB lea ecx, [esp + 0BB4h + WideCharStr]
. Text: 00498EE2 push ecx
. Text: 00498EE3 call sub_451C20
. Text: 00498EE8 push eax; lpString1
. Text: 00498EE9 call sub_473650
. Text: 00498EEE test eax, eax
. Text: 00498EF0 jz short loc_498F27
. Text: 00498EF2 mov eax, dword_4EA428
. Text: 00498EF7 cmp eax, 28 h
. Text: 00498EFA jg short loc_498F00
. Text: 00498EFC test eax, eax
. Text: 00498EFE jge short loc_498F27
. Text: 00498F00
. Text: 00498F00 loc_498F00:; code xref: sub_498700 + 7FA j
. Text: 00498F00 push 0; dwInitParam
. Text: 00498F02 push offset sub_4941B0; lpDialogFunc
. Text: 00498F07 mov byte_5150F8, 1
. Text: 00498F0E call ds: GetFocus
. Text: 00498F14 mov edx, dword_4D76B0
. Text: 00498F1A push eax; hWndParent
. Text: 00498F1B push offset aReminder; "REMINDER"
. Text: 00498F20 push edx; hInstance
. Text: 00498F21 call ds: DialogBoxParamW
As you can see, it only jumps when the following two statements are executed.
. Text: 00498EF7 cmp eax, 28 h
. Text: 00498EFA jg short loc_498F00
If eax is greater than 28 h, the system jumps to the DialogBoxParamW function. The decimal number of 28 h is 40. This value specifies the duration of the trial period. So far, the physical meaning of the variable dword_4EA428 has been very clear: the number of days since the installation of the program.
The protection mechanism has been found. What will we do next? For example, to prevent the "prompt registration" window from appearing, replace cmp eax, 28 h (83 F8 28) with xor eax, eax/nop (33 C0/90 ). In this way, the value of the eax register is always zero no matter what the current date is. The nop command is added to compensate for the length of the command (because the cmp command occupies three bytes, the xor command only has two bytes long, and the length of the command is shortened after replacement ).
Start hiew, winrar.exe. The initial interface is garbled. However, after pressing the "Enter" key twice, you can switch to the Assembly mode. Then press the "F5" Key (...... To specify the cmp command address:. 498EF7. Note that there must be no less periods (.) at the beginning, which is used to tell HIEW that the given value here is an address rather than the offset in the file. Press the "F3" key to switch to the Assembly editing mode, and then press the "Enter" key to specify the Assembly command to be executed. Next, a dialog box is displayed. Enter xor eax, eax, <press enter>, nop, <press enter>, and press F9 to save the result to the file, as shown in, and then exit.

 

Now, start WinRAR to see what will happen. This time, the annoying prompt is that the registration window does not appear again. The entire cracking process took less than 10 minutes.

Forced Registration
The registration window is successfully blocked, but the software is not registered. The title of the window will honestly prompt you that this is an evaluation version software. If you select the "About" command from the "Help" command menu, the software will prompt that this is a 40-day trial software. Although the trial version is not limited in terms of functionality, it is difficult to feel awkward.
WinRAR software registration is implemented through a key file containing a digital signature. This digital signature is generated through encryption to ensure that the tampered key is invalid. Therefore, it is almost impossible to forge a key file, but what we really want to do is to set the registration mark. To find this mark, go back to the key commands cmp eax and 28h.
We focus on the parameters of several commands above cmp eax and 28 h. You may ask how I know which parameter to view. In fact, I don't know which parameter is the key to cracking. This requires a lot of guesses and attempts. Of course, this is not a random guess. We can use the cross-reference feature of IDA Pro to understand the role of parameters. The so-called cross-reference is to view the commands in the code segment that call this command or parameter.
In IDA, move the cursor to the variable name, open the context menu, select "jump to xref (jump to cross reference)", or simply press the "X" key, the interface shown in is displayed.

 
The entire program contains a large number of cross references for executing read (r) write (w) operations. Select a row in the cross reference list, and double-click the left mouse button to jump to the corresponding position in the code.
Here, I will not list the parameters that I tried wrong. I will tell you where the key parameters are. This is actually the sentence.
. Text: 00498ECB cmp byte_4D70A0, 0
Here, the cross reference of the byte_4D70A0 parameter is shown in the case, and double-click the cursor in the write operation on the last three lines to go to the relevant code segment:

 
Here, the command at the 00497034 address is a reference location of the byte_4D70A0 parameter. The following commands are displayed:
. Text: 0049702F call sub_41C0D0
. Text: 00497034 mov byte_4D70A0, al
. Text: 00497039 test al, al
. Text: 0049703B jz short loc_497064; continue to register
First, call the sub_41C0D0 function, and then compare the returned value to jump to the zero value. In fact, sub_41C0D0 is the function for registration and authentication. If you are interested, you can go back and see how it is authenticated, I will not demonstrate it here.
Now, we can register sub_41C0D0 with a non-zero value.
Start HIEW and press the Enter key twice to switch to the disassembly mode. Press F5 to give the. 41C0D0 value, which is the first address of the function to be registered, and then press F3 to switch to the editing mode. Enter the following command: <press enter> xor eax, eax <press enter> inc eax <press enter> retn <Esc> (first reset the eax register to 0, then add 1 and then exit the function ). Press F9 to save the result to the file and exit HIEW.
Start WinRAR to see how it works. We can see that the evaluation version string has disappeared from the title of the window. The "register to" string is displayed in the dialog box, as shown in:
 
So far, WinRAR4.01 is cracked perfectly.

References:
Hacker disassembly (second edition)

Author: wxfengyun