==================================================================
  ணࠬ Windows (C) ED!SON [UCF], ॢ Mr.Boco/TCP
==================================================================


==========

1.    Windows-ணࠬ.
2.  SoftICE/Win 2.00.
3.  ॣ樮 .
    3.1. Task Lock 3.00 -        ᭮  ਩
         .
    3.2. Command Line 95 -  ॣ "-".
4.   祩  Command Line 95.
5.  ࠡ 樨 PUSH  CALL   ணࠬ  뢠
   㭪.
6.  ணࠬ, ᠭ  Visual Basic.


==========

A.   SoftICE 㦠 ᨬ  ( 㭪権 etc).
B. ⠪    㭪権    GetWindowText,    GetDlgItemText     
   GetDlgItemInt.
C.   ணࠬ.
D.  易  ஬.


1.    WINDOWS-
======================================

 ணࠬ Windows  設⢥ 砥    ,  祬
 ணࠬ Dos.  Windows ᫮ -   ⮣,
 , ᮡ ᫨ ணࠬ ᯮ ⠭  㭪樨
Windows.

ࢠ (  ⢥) ,   ॡ - 
SoftICE/Win 2.oo,   ⫠稪      NuMega.  
   祭 ᫮   ᯮ짮,      ᪠
,    ࠢ ,  ,    .  =)  
ਫ A  ਢ  ଠ,     ᫥
.

URL    ணࠬ,       ,   ਢ   
ਫ C.

- ED!SON, edison@ccnux.utm.my


2.  SOFTICE/WIN 2.OO
=========================

 ਢ 祭  奬  㭮,  騩  
SoftICE:

|--------------------|
|            |  'R' - ࠢ 祭 ॣ஢
|--------------------|
|          |  'D' - ᬮ , 'E' - ࠢ 
|--------------------|
|            |  'U' - ᬮ        ,  'A' -
|--------------------|        ⠢ 
|          |    ࠥ 
|--------------------|

㣨   ( ⠭⭮ ன):

'H'/F1    - .
F5/Ctrl+D -    ணࠬ   (   த    ࢠ
            ணࠬ).
F8        - 蠣 ⫠  室  ⥫ 㭪樨.
F10       - 蠣 ⫠  室  ⥫ 㭪樨.
F11       -   㭪樨 (㤥 ࠡ  ⮫쪮    ࢮ
            PUSH  㭪樨).

3.   
==============================

,  訩  ᯮᮡ   ࠪ⨪   -      
-  ॢ  (shareware)   ணࠬ      
ॣ஢ .


3.1 Task Lock 3.00 -    ᭮ ਩ 
==============================================================

 祭  :       䠪஢.

3.1.1 樭᪮ ᫥
==============================

 ࠧ來  ணࠬ  -  16    32  ?    
ॣ樮 ଠ?        ࠢ  -
।    ⮬,    ஥   ॣ?   ஡
⢥    । ⥬,   த.

....          ᫥....  
᫥? ... , 㦥 ?...

OK, ⥯  ,    32-⭮  ਫ,  ࠡ饥
  Windows  95      ॣ  砥    
ॣ樮    誥,  ஥  
  롨ࠥ  "Register|Register...".    ࠢ  
⠪ ⠫ ⭮,     ⨯  ॣ樨:  
㠫쭮 ᯮ짮   ᯮ짮  ""  (
ਣ  -  site  license).  ⮬  祭  ⭮,     
ணࠬ 㤥  ஢ન ॣ樮 .


3.1.2 뢠 ணࠬ
==========================

樮   ᥣ    窠 
⨯  Windows  Edit.  ⮡  ஢  ,   ணࠬ   
 ᮤন ப      㭪権:

     16-                      32-
     ------                      ------
     GetWindowText               GetWindowTextA, GetWindowTextW
     GetDlgItemText              GetDlgItemTextA, GetDlgItemTextW

᫥ 㪢   32- 㭪権   ⮬, 
ப ᯮ   㭪:  ⮢    塠⮢.
塠⮢ ப ᯮ  ।.  ,    
㦥 㫮  . "᫨   뫮 ࢠ    맮
GetWindowText..." -        ᤥ!!!    ᯥࢠ  
 㡥,  ᨬ  ( 㭪権)  㦥
SoftICE'. ᫨   ,   ᤥ -  .  ਫ
A.

⮡ ⠭ "" ( ᠬ    뢠  窮
⠭  ३⮬)  SoftICE,      ⫠稪
⨥  Ctrl-D  ᯮ짮    BPX.    ⢥
ࠬ     ᯮ짮      㭪樨,  
।⢥ .    "ꥪ 祭" (Task  Lock)
 32- ਫ,   ⠢ ३ 
㭪 GetWindowTextA. ᫨   , ஡ ⠢
३  㣨 㭪樨.   ப SoftICE 
᫥饥:

        :bpx getwindowtexta

᫨     ᮮ饭    訡  (ਬ,  "No  LDT"),
㡥,     䮭        믮    㣨
ਫ.  ⨫,    Norton  Commander    䮭  
稭   SoftICE.   ஢ 稥
३⮢ :

        :bl

 १  㢨 - ⨯:

        00)   BPX USER32!GetWindowTextA C=01

⮡   ⫠稪,  Ctrl-D ( F5)  ࠧ.

த... ⠪,   ⠭  ३    ⥯  SoftICE
㤥 "᪠"     맮  㭪樨  GetWindowTextA.
஡㥬   -  祭      ॣ樨  
 OK.   OK... ... 砥 檮 ᮮ饭 
⮬,     ࠢ. ,   뫠    㭪
GetWindowTextA...  ஡㥬   GetDlgItemTextA.      
३:

        :bc 0
        
(0 -   ३  ᯨ᪥ ३⮢)

 ⠭ :

        :bpx getdlgitemtexta

  , ஡㥬  ࠧ...


3.1.3  ⫠稪
=================

Wow! ⠥!       SoftICE,    ᠬ  砫  㭪樨
GetDlgItemTextA. ⮡  㤠,  㤠    뫠  맢,
 F11.        SGLSET.EXE.  ᫨    
㢥७  -  ᬮ              
 ப,   룫拉 ⠪:

        ----------SGLSET!.text+1B13----------

  㦥   ॠ  맮 㭪樨:

        :bd 0

᫨    ᭮ ࠧ , :

        :be 0

ࢠ ப    룫廊 ⠪:

        CALL    [USER32!GetDlgItemTextA]

⮡ ᬮ 窨   ,    Ctrl+Up  ("५
")   ,   㢨 ਢ  ᮪  .
᫨  祣    ᥬ,     ਨ
   .

        RET                              ;  㭪樨
        PUSH    EBP                      ; 砫 㣮 㭪樨
        MOV     EBP, ESP                 ; ...
        SUB     ESP, 0000009C            ; ...
        PUSH    ESI                      ; ...
    >   LEA     EAX, [EBP-34]            ; EAX = EBP-34
        PUSH    EDI                      ; ...
        MOVE    ESI, ECX                 ; ...
        PUSH    32                       ; .  ப
    >   PUSH    EAX                      ;  ⥪⮢ 
        PUSH    000003F4                 ; . ࠢ
        PUSH    DWORD PTR [ESI+1C]       ; .  
        CALL    [USER32!GetDlgItemTextA] ;  ⥪

  PUSH    ࠭  祭     ᫥饣
ᯮ짮.  ⨫  窨 ᨬ  '>'.    
 ,   ,      ⥪⮢    ࠭  
ॣ EAX   EAX  EBP-34h. ⮬   ⮨  
 EBP-34h:

        :d ebp-34

  뫨 㢨 ⥪,      .
      ,        ࠢ  
ॠ  ਩  ஬.  ⮬     蠣   㥬
ணࠬ   F10   ,   ⨬  -
 EBP-34.  ன  ᪮쪨 ᥪ㭤,     ⪭  
᫥騩 :

    >   LEA     EAX, [EBP+FFFFFF64] ; EAX = EBP-9C
        LEA     ECX, [EBP-34]       ; ECX = EBP-34
        PUSH    EAX                 ; ࠭ EAX
        PUSH    ECX                 ; ࠭ ECX
    >   CALL    00403DD0            ; 뢠 㭪
        ADD     ESP, 08             ;  ࠭ .
        TEST    EAX, EAX            ; ஢ 祭 㭪樨
        JNZ     00402BC0            ; 룠, ᫨  ""

 ,   룫廊  맮  㭪樨  ࠢ  
ப.  㭪 ࠡ⠥ ⠪:  室 -  ப,  室
- 0, ᫨  ࠢ   㣮 砭, ᫨  ࠢ.

 祬 ணࠬ ࠢ -   ⮩,   
  ?   ⥬,  ⮡  ஢  ࠢ쭮  襩
ப ( , , 㦥 )! -⠪,    
 뢠      [EBP+FFFFFF64]?  SoftICE    ᮢᥬ
४⭮ ࠡ⠥  ⥫묨 ᫠   ⮬  騩
 ᫥ :

        100000000 - FFFFFF64 = 9C

  ᤥ  ᫥ אַ  SoftICE:

        :? 0-FFFFFF64

᫮ 100000000 ᫨誮   SoftICE,  ⠭  0 
  ᠬ १.

 諮 ६  ,      뢠    
EBP-9C...

        :d ebp-9c

   SoftICE            -  
਩ !   ,   ਫ  ࠭?  ⨯
ॣ樨 -  ࠧ ਩ . ⮬ ᫥ ⮣, 
 ᠫ    㬠    ਩  ,  த
஢ ணࠬ   F10.    諨    ᫥饣
᪠ :

    >   LEA     EAX, [EBP-68]    ; EAX = EBP-68
        LEA     ECX, [EBP-34]    ; ECX = EBP-34
        PUSH    EAX              ; ࠭ EAX
        PUSH    ECX              ; ࠭ ECX
    >   CALL    00403DD0         ;  뢠 㭪
        ADD     ESP, 08          ;  ࠭ ଠ
        TEST    EAX, EAX         ; ஢ 祭 㭪樨
        JNZ     00402BFF         ; 룠 ᫨  ""

      EBP-68? ன ਩ !

        :d ebp-68

  ...  ,         稫    
யᠫ? =)


3.2 Command Line 95  -    ॣ  "-",  ᮧ
     祩
=================================================================

 ணࠬ - 訩 ਬ,      ⬮  樨
.

3.1.1 "᫥"
====================

 ᬮ५ ணࠬ  㢨,    32-⭮  ਫ,
ॡ饥      ॣ樨. 堫!


3.1.2 뢠 ணࠬ
==========================

 㯠 ⠪ ,    Task Lock' -  ⠢  ३.
  ⠢ ࠧ  ३    
㭪樨: GetWindowTextA  GetDlgItemTextA.  Ctrl-D,  ⮡
맢 ⫠稪     :

        :bpx getwindowtexta
        :bpx getdlgitemtexta

  頩    ࢠ  ணࠬ,       
ॣ樨        -    (몭
楫 ᫮ -     ).    ᠫ  ਬ୮
᫥饥:

        Name:   ED!SON '96
        Code:   12345

ணࠬ ⠭  GetDlgItemTextA.  ,    砥
 Task Lock',    F11  ⮡      뢠
㭪.  ᬠਢ          Ctrl+Up.  맮
㭪樨 룫廊 ⠪:

        MOV     ESI, [ESP+0C]
        PUSH    1E                   ; ᨬ쭠 
        PUSH    0040A680             ;  
        PUSH    000003ED             ; 䨪 ࠢ
        PUSH    ESI                  ; 䨪  
        CALL    [User32!GetDlgItemTextA]

᫮ 40A680   , ⮬    ஢塞  
:

        :d 40a680

     ,   , ஥   ?  =)  
⥯ ﭥ  ᮪   襯ਢ:

        PUSH    00                    ; ( ᭮)
        PUSH    00                    ; ( ᭮)
        PUSH    000003F6              ; 䨪 ࠢ
        MOV     EDI, 0040A680         ;  
        PUSH    ESI                   ; 䨪  
        CALL    [User32!GetDlgItemInt]

㭪 GetDlgItemInt 宦  GetDlgItemTextA,  頥 
ப,  楫 ᫮.  頥   ॣ EAX, ⮬
 㥬   (F10)  ᬮਬ,       
 ॣ஢ ᫥ 맮 㭪樨...   砥  룫廊
⠪:

        EAX=00003039

  ⠪ ⭠筮 3039? ६:

        :? 3039

 稬 ᫥饥:

        00003039  0000012345  "09"
        ^ hex     ^ dec       ^ ascii

   (, , 㦥 )  ,    
   . Ok,  ⥯? ᬮਬ :

        MOV     [0040A548], EAX      ; ࠭ ॣ. 
        MOV     EDX, EAX             ;  ⠪ 頥   EDX


3.1.3 뢠 ॣ樮 
=========================================

 ⨣ ,   뢠  ॠ  ॣ樮
!

        MOV     ECX, FFFFFFFF            ;  窨 뢠
        SUB     EAX, EAX                 ;  ப
        REPNZ SCASB                      ; .
        NOT     ECX                      ; .
        DEC     ECX                      ; ECX ⥯ ᮤন 
        MOVSX   EAX, BYTE PTR [0040A680] ; .   . 40A680h
        IMUL    ECX, EAX                 ; ECX = ECX * EAX
        SHL     ECX, 0A                  ;    0Ah 
        ADD     ECX, 0002F8CC            ;  2F8CC  १
        MOV     [0040A664], ECX

...   ஢

        CMP     ECX, EDX                        ; ࠢ ᫠
        JZ      00402DA6                        ; 룠, ᫨ ࠢ

  ஢  ࠢ ᥫ,   ᬮ,
      ॣ樮 :

        :? ecx

  砥  :

        000DC0CC  0000901324

 , ࠢ   : 901324.

 F5  Ctrl-D ⮡   ணࠬ  ஡㥬  
ࠧ,    ࠧ   ࠢ    (  筮  ଥ).
⠥!

4.     COMMAND LINE 95
=================================================

ﭥ   樨   ஡㥬 ॢ   
 .  祭   㫠,    ன  뢠
:

code = ((uppercase_first_char * length_of_string) << 0x0A) + 0x2f8cc;

砭 #1:  ᫥ 뢠,   ᨬ     
 뫨 ਢ    孥  ॣ,  ⮬    
ᤥ  .

砭 #2: "<< 0x0A" 砥 "㬭  2  ⥯ 10"

 ணࠬ   룫廊 ⠪:

        #include <string.h>
        #include <stdio.h>

        int main()
        {
                unsigned long code;
                unsigned char buffer[0x1e];

                printf("CommandLine95 Keymaker by ED!SON '96\n");
                printf("Enter name:   ");
                gets(buffer);

                strupr(buffer);
                code = ( ((unsigned long)buffer[0] *
                        (unsigned long)strlen(buffer))
                        << 0x0A) + 0x2f8cc;

                printf("Your code is: %lu", code);

                return 0;
        }

 ᭮!

4.   PUSH  CALL    
============================================================

 ﭥ  ᮪   Task Lock':

        PUSH    32                       ; .  ப
        PUSH    EAX                      ;  ⥪⮢ 
        PUSH    000003F4                 ; . ࠢ
        PUSH    DWORD PTR [ESI+1C]       ; .  
        CALL    [USER32!GetDlgItemTextA] ; 砥 ⥪

  뢠 㭪 GetDlgItemTextA    ணࠬ    C,
맮 룫廊 ⠪:

  GetDlgItemTextA(hwndDlg, 0x3F4, buffer, 0x32);
                  ^ [ESI+1C]      ^ EAX

PUSH ࠭      ,  뢠  ⥪.  
१    PUSH'    ᮪    頥   
 ⥪  ⥬ 뢠 㭪 ஢,    
⥪  ᯮ    ᢮ ᬮ७.

5.    VISUAL BASIC
===============================

EXE 䠩, ந Visual Basic',     騬
EXE.   ᮤঠ     맮  VBRUNxxx.DLL,  
⥬  ⠥      EXE    믮   ணࠬ.   
ன⢮ ᥢ-EXE 䠩  ⠪  稭  ⮣,  
ணࠬ  Visual Basic' ⠪ .  ⠪  EXE  䠩
  騬 EXE 䠩,     ஢  
ᥬ஢  -   맮 㭪樨    DLL    
.       㤥  ஢  ⠪  ணࠬ,  
"㤨"      DLL.   襭   ⮩   ஡    
.    ணࠬ, ᠭ 
Visual Basic' ᨩ 2  3, ᮧ  -,  뢠騬  ᥡ
DoDi.  ணࠬ    ॢ୮          
InterNet' (. ਫ C).  ணࠬ, ᠭ  Visual
Basic'  ᨨ  4   (VB      Windows   95),      
, ᪮쪮  ⭮,    ⥫, ⮡  
⢮. =)

ਬ砭: 騥 ணࠬ    Basic'. =)


=================================================================
                            
=================================================================


A.   SOFTICE   
===========================================

⮡   ஢,   㧨      SoftICE   ᨬ   
GetWindowText,      ⫠稪  ⨥    
Ctrl-D      ᫥饥:

       :exp getwindowtext

᫨   稫 ᯨ᪠  㭪権 GetWindowText,   㦭
।஢ 䠩 \SIW95\WINICE.DAT, 㤠 ᨬ 
(';') ।   祪 'exp=',  ᫥   ⥪⮬:
"Examples of export symbols that can be included for  chicago"  
 ⮣ 䠩.   㤠 ਨ    祪
'exp='  ࠭    ,  ᪮஢  ⮫쪮
窨  䠩 kernel32.dll, user32.dll   gdi32.dll,  
  ᠬ묨  묨.  ᫥  ⮣      ॣ㧨
.


B.   
==============================

 㤥  ,   뢠  㭪樨,      
ਫ, ᫨  㤥   ᠭ (樨):

int GetWindowText(int windowhandle, char *buffer, int maxlen);
int GetDlgItemText(int dialoghandle, int controlid, char *buffer, int maxlen);
int GetDlgItemInt(int dialoghandle, int controlid, int *flag, int type);

᫨    㦭    ஡   ଠ,   ᬮ   
㪮⢥ ணࠬ Windows/Win32.


C.   
======================

  

 SoftICE/Win 2.oo:  http://www.geocities.com/SoHo/2680/cracking.html
  VB:   ftp://ftp.sn.no/user/balchen/vb/decompiler/

,    

 TaskLock:          http://users.aol.com/Sajernigan/sgllck30.zip
 CommandLine 95:    ftp://ftp.winsite.com/pub/pc/win95/miscutil/cline95.zip


D.    
==========================

 IRC (EFNet):         #Ucf96, #Cracking
E-mail:                edison@ccnux.utm.my  an461165@anon.penet.fi
  WWW-࠭窥: http://www.geocities.com/SoHo/2680/cracking.html

==============================================================================
