Archive for April, 2007

Excellent idea for a contest, now at WTF. The judges are nobody else than famous Raymond Chen, Joel Spolsky, and Jeremy Zawodny. I’m in !

Did you know about them ?

int? i = 5;

i = null;

Here the HATRED cracking group is making fun of the poor cracking performed by another group, ViTALiTY. Assembly code included and commented.

This is the code as it looks after SecuROM has molested it. Thiswas once a real routine in the virgin executable and clearly playssome sort of role as a part of the game code. Partially relocatedroutines is a common SecuROM feature and you will see it have beenfixed in several previous hatred releases. We were impressed thatViTALiTY was able to crack an executable with this feature so wedecided to take a closer look.

OH MY GOD!

004ACB80 B8 00000000 MOV EAX,0004ACB85 C3 RETN

What a sophisticated fix. Seems ViTALiTY have decided that thisroutine is not important and since they were unable to rebuild theoriginal code they simply inserted a MOV EAX,0 RETN which meansthat the entire routine is now disabled. It is not for us to judgewhether this routine is an essential part of the game code. If theViTALiTY crack appears to run flawlessly then it probably isntbut the fact remains that this code was in the original executableand therefore it should also be in the cracked executable. This isan undeniable fact and any unbiased cracker you ask will agree.

Here’s the answer.

And the follow-up.

Beginner’s guide

Which ones are global and which ones are local ?

- System Handles (such as files, sections,
mutexes, semaphores, processes, threads, jobs, …) are bound to a
process and are only valid in it’s scope. They may be inherited with
CreateProcess() (depends on how the handles were created) to other
processes or – as you mentioned – duplicated into the scope of another
process. In kernel mode attaching to another process makes it’s handle
table available.

- User Handles (HWND, HICON/HCURSOR, HACCEL, …)
are global for all processes that share the same window station. They
don’t need to and can’t be marshalled. However, system security may
prevent access to objects belonging to threads of other desktops or
when other restrictions are active (such as UI restrictions by jobs)

-
GDI Handles are session-global. However, it’s only possible to access
global GDI handles, such as stock objects, and GDI objects created by
the process itself. But the handles are unique, so it’s impossible that
there are same handles for different processes that are assigned to two
different objects.