Thursday, October 13, 2011

Reverse Engineering Practical - Reversing Winrar into full version(Featured)

Hello friends,
I hope you all are fine.Previously I have posted articles on REVERSE ENGINEERING (Basics) and REVERSE ENGINEERING (ADVANCED)-ASSEMBLY LANGAUGE .Today I'm giving you a practical example of reverse Engineering.Here I'm explaining the Reversing Winrar.
This tutorial is intended for those who are new to reverse engineering and disassembling.

Disclaimer – By Reading this tutorial You agree that this tutorial is intended for educational purposes only and the author can not be held liable for any kind of damages done whatsoever to your machine, or damages caused by some other,creative application of this tutorial.
In any case you disagree with the above statement,stop here.

The Tools
To perform this hack you will be needing -

Any De-assembler (I use Hackers Disassembler and Hview )
You will be able to get them by Googlong. ..

How to Reverse Engineer?
You need to have a bit knowledge of assembly language,and in case you don't have it,just cram the steps and it will work anytime,every time. Download the latest version of WinRAR from their website and install it.
I will be cracking Winrar 3.80 here (cuz I already have it:P ). This is basically just  2 step process

Now copy the WinRAR.exe file to desktop. Make a copy of it there. 

Step 1 – Hunting for Memory Address
Now load Hackers Disasembler and load the copy in it.

The Disassembler will disassemble the executable in assembly code. Now you need to search for strings that are used in WinRAR program. Press Ctrl + F and type “evaluation” without quotes and search in the assembly code. Hit enter..

After you have reached this block of code by searching, just look at the block of code above it. There you will find that some assembly values are being compared and then code is jumped to some other function. Now see carefully, the “evaluation copy” function must be invoked after some specific condition is met. We need to look for it at the code and the make certain changes to the condition so that the program doesn't checks for the condition.

In the above code you can see this code -

00444B6A: 803DF4B84B0000 cmp byte ptr [004BB8F4], 00
00444B71: 0F859B000000 JNE 00444C12
This is the code responsible for validating you as a legal user :) . Just note down the memory address that leads to jump (JNE) at some memory location. In this case, note down 00444B71 .
Note : For any WinRAR version, this code and memory address might be different,but the JNE will be same. Just note down the respective memory address that checks.
Now you need to search for the code that brings that ugly nag screen “Please purchase WinRAR license” after your trial period of 40 days is over. For this,look over your toolbar and click on “D” which stands for looking for Dialog references.

Now in the dialog box that opens,search for “please” and you will get the reference as -

ID-REMINDER, “Please purchase WinRAR license”
Double click on it and you will reach the subsequent code.

The code will be something like
* String: “REMINDER”
0048731A: 68EB5E4B00 push 004B5EEB
Just note the memory address that invokes the REMINDER dialog. In this case its 0048731A. Note it down.
Note : For any WinRAR version, this code and memory address might be different.But the Reminder Memory address code will always PUSH something. Just note down the respective memory address that PUSH ‘s.

Step 2 – Fixing and Patching
Now in this step we will be patching up values of memory addresses we noted earlier. I will be doing this using HVIEW.
Now load the copy you disassembled in Hacker’s Disassembler in Hview.

After you have loaded it, you will see the code is unreadable. Its just like opening an EXE file in notepad. You need to decode it. To do that, just press F4 and yoiu will get an option to decode it. Hit DECODE and you will be able to see code in the form of assembly code and memory addresses.

After you have done that, you need to search for memory addresses you noted down earlier. Just hit F5 and a search box will be there. Now you need to enter the memory address. To do that, enter a “.” and the type memory address neglecting the earlier “00” . The “.” will suffice for “00”. ie -

Type .444B71 in place of 00444B71

and search in the code.

After you have reached the respective code, you need to make changes to it. Press F3 and you will be able to edit the code.Now make the following changes -

After you have done it, save it by pressing F9.
Now search for next memory location by pressing F5 and entering it. Reach there and make the following changes by pressing F3 -

Save the changes by pressing F9 and exit HVIEW by pressing F10.
Yipeeee...Congrats..You have cracked WinRAR :) Replace the original WinRAR.exe with this copyofwinrar.exe by renaming it. :P

You Can Crack other softwares with this method.
In my next Tutorial,I will explain how you can change the copyright information and how to create your own cracked patch of any software.Till then keep rocking.

Note:I hvn't include the download link of s/w here.If you have difficulty to find s/w used then let me know i'll upload it and provide you download link.

If you face any problem in above tutorial feel free to ask anything.
Hope you like the efforts.



Brixares said...

nice dude. . .i have learned something applicable from you. . . thanks. . .!!!!

Peeyush Jain said...

Your Welcome Brixares...
Keep visiting...


Post a Comment

Design by Free WordPress Themes | Bloggerized by Lasantha - Premium Blogger Themes | Web Hosting Bluehost