Richie86’s Life!!

It’s all about me!!

Unpacking Themida/WinLicense 1.8.x

Posted by Richie86 on January 24, 2008

Title: Unpacking Themida/WinLicense 1.8.x
Author: Richie86
Tool Preparation: OD + Phantom + okdodo script + PEiD + ImportRec
Packer Used: WinLicense 1.8.9.0
Software Name: Cpp1.exe
Software Size: 152Kb(Original), 1.37Mb(Packed)
Operating System: Windows XP SP2

Cpp1.exe (Packed) Download
Cpp1_src.exe (Non Packed) Download
———————————————————————————————————-

Software Introduction:
1. OD
Also known as OllyDbg. It’s a 32-bit assembler level analysis debugger. Powerful tool to analyze 32-bit assembler. More info see http://en.wikipedia.org/wiki/OllyDbg

2. Phantom
It’s a plugin for OllyDbg. Used to prevent the OllyDbg from being detected by anti-debugger engine for Themida/WInLicense.

3. okdodo script
This is the unpack script we will use in this tutorial.

4. PEiD
PEiD detects most common packers, cryptors and compilers for PE files. It can currently detect more than 600 different signatures in PE files.

5. ImpportRec
Import Reconstructor is a tool that used to fix the IAT of dump image and reconstruct them.

You can get these tool easily from http://www.unpack.cn

———————————————————————————————————-

Okay let’s get started.

First we have to determine what is the packer first. Drag Cpp1.exe into PEiD. You will need the latest signature database. Here we found it’s pack with Themida/WinLicense 1.8.2.0 above.
PeID
Start your ollydbg, make sure your phantom setting is like below. Configure it by pressing Plugin>Phantom>Option . You will need to restart ollydbg for setting to take effect.
Phantom Setting

After that drag Cpp1.exe into ollydbg. See the yellow line in main thread. B8 00 00 00 60, common entry point used by Themida/WinLicense.
load.jpg
Pressing ALT+M to switch into Memory Map tab. Drag down a little bit the list and you will found msvcrt on PE Header. Shows that this EXE is using C++ Runtime.
C++

Let’s continue. Run okdodo script by pressing Plugin>ODbgScript>RunScript>then select okdodo.osc

The script will automatic run. After you being prompt that the script has completed. The debugger will stop at the OEP (Original Entry Point) of your EXE.
oep.jpg

Take note of the OEP address above. We will using it later on. 00401151
Next we will try to dump the image out. Do NOT close OllyDbg yet.
Open your importRec. Attach the process to the Cpp1.Exe in the list.

Then you will see in the status box. Image Base: 00400000. So calculate the OEP by 00401151-00400000 = 1151
Fill in into the OEP box and press IAT Auto Search. It will inform you that the OEP is found.

Press Get Import to get all import function. From the Imports status, shows that valid:YES. Which means all imports function pointer are match.

So dump the image by RightClick>Advanced Commands>Select Code Section(s)
imprec.jpg

Press Full Dump. then save it at somewhere as cpp1_dump.exe
dumped.jpg

Then continue to reconstruct the dump base on new OEP. At main menu. Press Fix Dump, then select the dump image cpp1_dump.exe we create just now.
fixdump.jpg

After reconstruct. New image cpp1_dump_.exe is created. And now try to open the cpp1_dump_.exe and you will see you are sucessfully unpacked it.
done.jpg

Credit: okdodo for the script. unpack.cn for the resources.

Posted in Reverse Engineering | 85 Comments »

ID Combinator Source

Posted by Richie86 on January 12, 2008

Releasing it.. some of friend interest on how it work..

Download Link:

http://www.sendspace.com/file/1spdgk

Posted in Programming | Leave a Comment »

View Point..

Posted by Richie86 on January 9, 2008

Different people may have different view point. Some people judge something from good aspect, some people judge something base on what they feel.. I feel totally regret that I made the wrong decision by telling the college that their website is sql injectable. I don’t get anything useful from that but just the intention for them to aware of this issue. But unfortunately, they doesn’t think like what I expected, non of them appreciate my intention but somehow conclude that I’m doing the wrong thing. If I know they will say so I’d rather keep silence until someday someone else hack into their server and destroy everything and I’ll never bother about it anymore.. Sian.. looks like the system in USM and TARC are really different.. one is college and another is university.. Their staff.. their way of managing thing is really different.. well anyway.. forget about it.. just hope to finish my study and get a life in future.. nothing in TARC is meaningful to me.. except every of my friend that together with me, support me..

Posted in College Life | 1 Comment »

Richie86 Boxes Game

Posted by Richie86 on December 24, 2007

This is the game that created by me, you need some logic thinking and patient only able to solve it. It’s kind of puzzle game.. If you having problem for running it, install .net Framework 2.0 that can be downloaded from Microsoft.

After few update, it’s quite hard to hack this game anymore. In Version 3.0 you can just simply load it in olly and find the boolean value refer by the function called each time you press a box. But now you have more thing to do to exploit it, and the most difficult is.. you have to bypass the validation of simulation, you can cheat by change all box to black which is very simple, but during simulation it will replay whatever step you had made and that time it will know whether you cheat or not.

Score evaluate by recording your startup time and the time where you solve the game. May be you will think of freezing the time or change it though system clock, try it and see what happened.

Offline Database (score.dll) is just using MS Access without password protect but you can’t just modify your score there.

Download Link:

Game program:
http://hoangyuh.googlepages.com/Richie86BoxesGame3.5.rar

Replay Script Collection:
http://hoangyuh.googlepages.com/RBGSCollection.rar

Main Interface

Online Ranking

Simulation Playback

Change log:
Version 3.5
- Tweaked simulation speed
- Fixed threading problem in simulation

Version 3.4
- Introducing Simulating Engine
a) Anti-Hack Mode
b) Replay Mode
- Minor bug fixed

Version 3.3
- Quick fix on ranking system

Version 3.2
- Added a mini Anti-Hack Mechanism
- Exe packed!
- Improved Synchronizing System

Version 3.1
- Fixed some bugs
- Added mini Anti SQL Injection Engine
- Added restart button

Version 3.0
- Introducing Ranking System
- Introducing Anti-Cheat System (Try to cheat and see :P)
- Introducing Online Database Synchronizing Support
- Improving GUI, Help menu added with tutorial and hint
- Added Automated MSN Adding Feature

Version 2.0
- Remodify Score Evaluating System
- Improving game difficulty to 5×5 boxes game

Version 1.0
- Original 3×3 boxes game
- Introducing Score Evaluating System

Posted in Programming | Tagged: , | 2 Comments »

Imagine Day 2007.. A Successful Day but something dissapointed happened behind..

Posted by Richie86 on December 21, 2007

Its Imagine Day 2007.. when I walk into our college hall, I was impressed with the environment.. it’s like PC Fair . I have a very good memory in this day as I won the prize for Algorithm Challenge, how ever.. something disappointed me when I figured out something which is totally unfair to me.

During the briefing before the competition, we are informed by the instructor that the prize for Algorithm category is a wireless mouse which worth RM200. However, when I receive the prize, there is no wireless mouse. but just a magazine with some free gift.(By right the champion of each category should get a prize like keyboard set and so on, then come together with the free gift and magazine) At first i was not take it serious since I’m glad what i had achieve, my dear, friends,classmate, course mate are came and give me support all the day.. especially my class/course rep Daniel, who reach in the hall in the afternoon and giving me a lot of support.

How ever on the second day, while talking to my friend, I realize that he doesn’t even know the prize changes since he is the instructor for our competition, and surprisingly the “wireless mouse” appeared in the committee lucky draw during the celebration dinner last night. I started to feel unfair to me so we decide to figure out the truth. We had spoke to the chair person Kok Chiann, who was the well known student in our college, as well as Microsoft Student Partner. What I had receive the explaination is… (see the conversation log below)

Session Start: Thursday, December 20, 2007
Richie86 (ghykthyybfk@hotmail.com)
AH Hang(hgun77@hotmail.com)
KC (kokchiann@hotmail.com)


(5:54 PM) AH Hang: hi kok cian
(5:54 PM) AH Hang: morning~
(5:54 PM) AH Hang: i wanna ask some thing...
(5:54 PM) KC: oooo
(5:54 PM) AH Hang: Richie is the algorithm winner
(5:54 PM) KC: hehe
(5:54 PM) KC: i know
(5:54 PM) KC: congrats man
(5:54 PM) Richie86: wireless mouse gone :X
(5:54 PM) AH Hang: wanan ask some thing
(5:55 PM) AH Hang: the gift that he get... is all seem like very big diff wiv what u told me wo
(5:55 PM) AH Hang: what u get richie ?
(5:55 PM) KC: discussed with the school and re-organized the prizes
(5:55 PM) KC: got approval with both Microsoft and TARC
(5:56 PM) AH Hang: what do u get richie ?
(5:56 PM) Richie86: oo
(5:56 PM) Richie86: magazine.. vs2008, game, 50.NET, concert ticket
(5:56 PM) AH Hang: seem like very big diff with other category.
(5:57 PM) AH Hang: this all seem like "free gift"
(5:57 PM) Richie86: wireless mouse goes to lucky draw?
(5:57 PM) KC: hmm, so what u plan i do for it?
(5:58 PM) AH Hang: hard to imagine algorithm can survive in imagine day 2008 or not.
(5:58 PM) AH Hang: just need to explain to richie la.. cos he word so hard for that
(5:58 PM) AH Hang: i just connect richie to u...
(5:58 PM) Richie86: how come suddenly change the prize?
(5:58 PM) KC: frankly
(5:58 PM) KC: the prizes were P&C
(5:58 PM) KC: and we have the full right to change it, even the rules
(5:59 PM) AH Hang: bcos compare to other category,....
(5:59 PM) KC: so, please understand
(5:59 PM) Richie86: luckly the person get is me.. -.-
(5:59 PM) AH Hang: just feel a bit unfair for richie
(5:59 PM) Richie86: because chu hang do told every finalist about the prize too..
(5:59 PM) Richie86: so if other one that won, but doesn't get it then..
(6:00 PM) KC: ok
(6:00 PM) KC: i explained to you
(6:00 PM) KC: i doubt i need to repeat myself
(6:00 PM) KC: u shud be thankful you have won, ok?
(6:01 PM) AH Hang: ok, richie... u can close ur msn d.
(6:02 PM) AH Hang: by the way
(6:02 PM) AH Hang: u can do something richie
(6:03 PM) KC: remember its not about the prizes, but the TARC Imagine Cup is to prepare you guys for the actual Imagine Cup
(6:03 PM) KC: so u get a better picture of what you would need to do in the actual Imagine Cup, for the categories u participate in
(6:04 PM) AH Hang has left the conversation.

Session Start: Thursday, December 20, 2007
Richie86 (ghykthyybfk@hotmail.com)
KC (kokchiann@hotmail.com)

(9:30 PM) KC: hope u understand, our event very tight budget and alot of constraints, ok? the prizes we get also very limited and hard to allocate and we did the best we can, ok?
(9:30 PM) Richie86: ?
(9:30 PM) KC: regarding the prizes
(9:30 PM) Richie86: hmm
(9:31 PM) KC: anyway u won a desktop set in lucky draw aso
(9:31 PM) Richie86: so that the reason it get removed?
(9:31 PM) KC: nope
(9:31 PM) KC: it was allocated early morning, based on the prizes given
(9:31 PM) Richie86: but it appeared in committee lucky draw..
(9:31 PM) KC: i had no idea u won anyway
(9:32 PM) KC: yes, it was reallocated in the committee lucky draw, who worked hard in organizing this gigantic event
(9:32 PM) Richie86: and nobody knew "changes" that you mention too
(9:32 PM) Richie86: glenn the person in charge, or huey chen too
(9:32 PM) KC: well, it got the approval of the main decision making parties, the school and microsoft
(9:33 PM) KC: u think everyone has so much time for everything?
(9:33 PM) KC: so i hope u understand, k?

After, I tried contact few committee like Huey Chen(another MSP), and here is the conversation.

Session Start: Thursday, December 20, 2007
Richie86 (ghykthyybfk@hotmail.com)
H.Chen (hc_lim@hotmail.com)


(7:29 PM) Richie86: hi
(7:29 PM) H.Chen: yup
(7:30 PM) Richie86: i have some question to ask you
(7:30 PM) H.Chen: ?
(7:30 PM) Richie86: do you know the prize of imagine day 2007 for software design.. project hoshimi.. and so on?
(7:31 PM) H.Chen: hmm....the list not with me, but i can ask
(7:31 PM) Richie86: who is the person in charge O.o?
(7:33 PM) Richie86: I s that a "changes in prize" happened?
(7:34 PM) Richie86 has changed his/her personal message to "BRB"
(7:35 PM) H.Chen: hmm.....i think no


Session Start: Thursday, December 20, 2007
Richie86o Wo (L) Ni O (ghykthyybfk@hotmail.com)
H.Chen Imagine Cup 2007! Success and Sweet Memory!!! (hc_lim@hotmail.com)


(9:34 PM) H.Chen: hi
(9:34 PM) Richie86: hi
(9:34 PM) H.Chen: can i know what u get for the prize?
(9:35 PM) Richie86: standard set
(9:35 PM) Richie86: magazine, disc, game, 50.NET, music concert ticket
(9:35 PM) Richie86: KC admitted that the "wireless mouse" is reallocated to commitee lucky draw
(9:42 PM) H.Chen: as what we consider is, because algorithm is on the spot coding, less preparation compare to other category and is also a solo. we already try our best to allocate the prize.
(9:42 PM) H.Chen: anyway, we will further look into it with lecturers
(9:42 PM) Richie86: hmm
(9:43 PM) Richie86: but looks like you, glenn and everybody doesn't know about this "reallocation" before this
(9:44 PM) Richie86: I'm sure both of you do spoke to KC too
(9:45 PM) H.Chen: because i not incharge of the prize....so i not sure about this
(9:49 PM) Richie86: glenn is the person
(9:49 PM) Richie86: he dont know too :X
(9:50 PM) Richie86: Initiated a file transfer
(9:50 PM) Richie86: may be you will interest in this log
(9:52 PM) H.Chen: can resend please
(9:53 PM) Richie86: Initiated a file transfer
(9:53 PM) Transfer of "log.html" is complete.
(10:13 PM) H.Chen: nvm....we will discuss with lecturer first....but 1 confirm, we cant do anything
(10:15 PM) Richie86: ya
(10:16 PM) H.Chen: then we will let Ms Kathleen and Mr Yong decide on this
(10:17 PM) Richie86: sure


Session Start: Friday, December 21, 2007
Richie86(ghykthyybfk@hotmail.com)
t3ngf0ung (cheah_yuin26@hotmail.com)


(1:10 AM) t3ngf0ung: anything u would like to complain, let me know
(1:10 AM) Richie86: have KC told you?
(1:12 AM) Richie86: as told by Chu Hang.. the prize for algorithm is a wireless mouse, unfortunately it "converted" to committee lucky draw prize
(1:26 AM) t3ngf0ung: we never finalize the prizes until the Imagin Day itself... so what have you heard before the Imagine Day is not black and white...
(1:26 AM) Richie86: erm
(1:26 AM) Richie86: i heard it on the day
(1:26 AM) Richie86: the moment before competition
(1:28 AM) Richie86: and i understand also the committee have the right to make changes too
(1:28 AM) t3ngf0ung: its not the changes issue
(1:29 AM) t3ngf0ung: is, never tell to any of the committees about the prizes of the winners, who only the core committees know the lists
(1:30 AM) t3ngf0ung: the rumor u heard about wireless mouse as winner's prize is not true.. we never made any changes
(1:30 AM) t3ngf0ung: we decide the prizes according to the competition scope, efforts and sacrificing
(1:30 AM) Richie86: erm KC admitted that the price is changed to committee lucky draw
(1:33 AM) t3ngf0ung: he does?
(1:34 AM) Richie86: yep
(1:34 AM) Richie86: whatever you said just now is told by KC?
(1:34 AM) t3ngf0ung: nop
(1:35 AM) t3ngf0ung: what KC said is solid...
(1:37 AM) Richie86: hmm nvm on that.. at least Chu Hang stand on my side..
(1:38 AM) t3ngf0ung: whati want to tell u again is, we decide the prizes according to the competition scope, efforts and sacrificing
(1:38 AM) t3ngf0ung: hope you understand
(1:41 AM) Richie86: all right

as you can see in the conversation log, he claim that this is approved by Microsoft and TARC. But while I try to ask Mr Yong(Advisor of CS Society that organize this imagine day event) whether its truth or not, he doesn’t claim that is truth but just tried to change topic to avoid my question. Then I further asked him that whether KC had contacted him last night regard this, and yes he said. and before this, as an Advisor of CS Society, he doesn’t know the so called “Reallocation of prize” is made until KC contact him last night, as well as the “approval” from school and Microsoft as well. I couldn’t sleep last night because of the dissatisfactions in my heart, so I wrote up the letter and print out 4 copy which will be given to Mr Yong and Miss Kathleen (The Advisor of CS Society), Miss Lim (Program Supervisor of Advance Diploma in Computer Science), and lastly Dr Ng (the acting head of SAS).

Furthermore, Mr Yong said that there is equal fair for Algorithm Category compare to other category, this issues is just happen in sudden and nobody realize that, and he said the committee’s lucky draw were just the ‘left over’ stuff from the event, they don’t realize there is a mistake in this case. However if this is truth, why KC admitted that it’s transferred to the lucky draw. Furthermore, My Yong agreed that its same effort from each category, everyone had does their best, but i’m so unsatisfied that the committee take that as the reason for this issues. If it’s as easy or simple as they said, I would like to ask those who are MSP that have a lot of knowledge to the latest Microsoft technology, good programming skill and so on, “Do you ever know how to print out all possible combination of a poker card set, given the number of card for each combination without using a for/while/do while loop. nCr where n = 52, and r is given by user? Because of this competition, i do my research on the algorithm, and practice it so I can code it in the shortest time, and my record is 11min. Is this not the effort? I can code on the spot in front of any of them if they requested.

After spoke to Mr Yong, i feel that Miss Lim and Miss Katheleen had the right to know this, so I pass the letter to them too. I kept Dr Ng’s copy on my hand first because I dont think this is a good news to her, perhaps this can be solve equally and fair to me, to the committee, the lecturer, the school, the student, and the public too. Furthermore, if the “approval” that KC mention is an hoax, I’m sure he will know what mistake he had made, for abusing his power as chair person, as MSP , and also abusing name of TARC and Microsoft. ( I can just simply wrote a letter to Microsoft Malaysia and the the whole things will come to obvious)

While writing this blog, I checked my mail to see if i get any result from news paper group because last night I left a email to them, asking them whether they are interested in this issues or not. and China Press had replied my email and asking for my phone number, but I haven’t gave them yet since it doesn’t have to go further till that situation.

Lastly.. I know that most of them are well known student in TARC, If i’m trying to fight with them, most of the lecture will stand on their side, however, we should voice out for the truth right? even whole college doesn’t stand on my side, but at least.. my dear, my class mate (even their event crew member who were my classmates support on me too), my friend, and I’m sure the public as well. My dad said this to me too, “社会上假公济私的人大有人在, 上一次高当学一次精” (which means, there are a lot of jobbery issues in the real world society, when we get fool by someone, we learn to be smart against the future. This really pissed me off totally..

Posted in College Life | Tagged: , , , , , , , , | 18 Comments »