ActiveM***

Hi all !
Please, let me tell you something about trymedla. There is no need to rebuild anything to crack an application 'protected' with this layer.
I suceeded in cracking recently this (over 600Mo) game : Sec0nd 5ight.
This target is available to dowbload as a 15 min. demo.
Protected by trym*dia, it could be broken with only a few bytes changing in the original file.
Trace into the proggy until you reach the nagscreen saying 'xx min letf' or 'time out : now buy the game !'.
Then, try to break just after you return from that screen.
Then, using F10, just try to find a stupid and simple test EAX,EAX + JZ/ZNZ.

If you reverse the jump, the game starts.
Try to find back the routine which has been called just before this JZ/JNZ test.
Put a breakpoint onto this routine.
Close the proggy and start it again.
What happened ? Softice break at your breakpoint.
You are right in the 'LICENSE testing routine'. It returns 1 if GOOD or 0 if BAD.
If you want to reverse-engineer this, just do it : obfuscating is only a bit annoying... not really a big deal.
There is no intergrity check in this protection, then, you can include a modifying code just after decompression routine to modify the result from License check.

No more bad protection on these proggies.

have fun... bye !
frip.

[MEPHiST0]

hi everyone

recently i downloaded a 'trial version' of a video game.
the video game is complete tho, the only trial is ActiveMark protection.

i wanna play this game
so i spent some time on it last night and took some notes for everyone..

1: Debug check..
The EXE add's a command line to the exe if there is a debugger detected..
(how the debug detection works im not sure)

Load in Olly, set a memory on write on SECOND .TEXT section (mines 5f2000), now follow the address of the second text section in teh dump window.. now Shift+F9 once, and wait for it to Break, once it breaks.. you will see this below:
MOV ECX,.005F3020 ; ASCII " --MPRMMGVA--"
this added command line is what stops the game from launching any further.

at the beginning of the second text section (005F2000)
is where the command line.. "c:/Games/thisgame" --MPRMMGVA--" is.
(if you shift+f9 acouple more times you will see this appear in the begiinning of 2nd text section)
simply from memory, in the dump window, ERASE the --MPRMMGVA-- either from the address from ECX or at the beginning of 2nd .text section.

it seems the first time i bypassed this debugger, it allows me to run the exe without fixing the debug check everytime... so once you fix it the first time, it should be fixed forever in your olly as long as u have the .udd file

2.) FAKE OEP.. or second layer OEP..
PEiD came very handy at this point, using PEID Generic OEP finder.. scan the exe and get the OEP with PEiD.. this is the second layer OEP.. (if you leave that memory on write on .text, and set a hardware break on the 2nd layer OEP... you will break there..)
the second layer is nothing special.. it has the Trial Info and stuff..

if you execute from the 2nd layer OEP.. you will get the 'you have 200 minutes remaining' Notice. (UNLESS you are executing from dumped EXE.. then a certain long jump in a CALL under the first GetModuleHandleA in the second layer EP.. if you change this long JE to JNE then the dump will launch)

if you look from teh second layer EP.. down just alittle, under GetModuleHandleA there is a CALL.. this call takes us thru 2 Process's
1 - Trial stuff
2 - JUMP to OEP

notes: at OEP, there seem to be some Redirected API CALLS
the redirected API CALLS are not too difficult to find.

I Might work on a OLLY SCRIPT to fix the redirected API CALLS,
otherwise heres how i started to fix them:

at real OEP.. i search 401000 for: "90 E8" without qoutes, setting a breakpoint on every one i find..
it seems ALL the Redirected API have NOP instruction before the redirected CALL.. so they are easy to find

this is all the info i have right now..

ill write a tutorial for this protector if i succeed with unpacking it..
all i have left to do is find the rest of redirected API

good luck, see you all soon.

Thank you Mephisto for these informations (in many ways, it's exactly what I've seen when tracing into this protection).
Nevertheless, I'm still thinking that creating a few bytes patch to crack tr*media is :
1 - simpler for lazy people like me
2 - a lot smaller result than a complete rebuilt exe (5 or 6 kb vs many Mb)

This way, It could be possible to make an 'pretty simple' automated tool to crack 'every' application protected by the last version of this protection.


once more, thanx.
frip.

I never investigated the ripped API's since one could simply launch the app from the second layer EP, but that signature you talk about (having the NOP's and then a call into ripped API) sounds a lot like how Ultraprotect worked.

Should be possible to make a ImpREC plugin for this, simply scan for calls into high mem (easy to do) and decode where they go. However, not sure if that's possible only because I never looked at a ripped API. (I didn't bother, only dumped at second EP to let it decode for me)

-Lunar

[MEPHiST0]

yea dumping at the 2nd layer EP.. or licence layer EP... is probly the best..

i dumped at the 2nd EP.. and my game runs, with the trial stuff.. i patched the trial stuff to just run the game....
all the fake CALLS are working ok...
but the exe is still messd up from somthin, cause it is crashing, all my targets are crashing, just minor stuff, almost got one fixed completly, everytime i fix somthin, somthin else is broke.. :|

but ive yet to get a completly unpacked exe.. i cant code much so coding a pluggin for imprec is outa the question

although i did some research on teh fake calls..
not ONLY are some CALLS faked.. jump dwords to API are faked as well.. inbetween FF25 there is 90E8xxxxxx
but they are all simular..
(in my dumped at OEP.. the fake calls dont execute the right code, due to a long jump in every fake code process)
in mine, all the fake calls take me to a CALL DWORD.. to GetModuleFileNameA..
then a bit after this is the API that it really fucked... (but in dumped at OEP this real API doesnt get executed because of a long jump)

mm still yet to play my gamewithout trial :|

[Nacho_dj]

Another issue of AM protection is the one related to functions and dll's.

AM protection removes some of the functions provided in the import table by the original program. So, in order to rebuild the program, you will need adding these lost functions (api's), or even, some dll.

It happens in functions such as Direct3DCreate8, belonging to d3d8.dll. When a nop + call is referencing to it, the rebuilding of this function has to include the insertion of the function in the import table, and, if no present, of the dll.

I do not know whether there is a tool doing this. I have included this function in the rebuilder I am developping, but it has been a difficult task.


When tracing the nop + call redirection, you can get a LoadLibrary "d3d8.dll", and then, GetProcAddress of "Direct3DCreate8".

So, another issue that has to be fixed...


Cheers

Nacho_dj

[Nacho_dj]

Because of adding a new API, deleted by the AM protection, in the action of rebuilding the program, you will find at least two possibilities:

- Adding it following the last name of function in the import table. This is only possible whether the dll owner of the function has to be added too, because previously did not exist in the file.

- Inserting it in the middle of the import table. This case is when the dll owner of the function exists in the import table.


The first case is more or less easy to solve. But it is necessary rewriting all the values of IAT and Original First thunk, and adding a new function name. It has to be done with a lot of care in order to get the rebuild working.

The second case means that you need to rewrite all values of first thunk, IAT and original first thunk, plus modifying the function names list. It involves the appropriate changes in a lot of calls to api's, in order to remain calling to the original api.

This is another issue that a rebuilder of this protection needs to fix.

I have found in internet some tools "doing" this, but none of them working totally.


Cheers


Nacho_dj