How to crack winrar ? | Reverse Engineering
In this tutorial I will show you the attackers approach of simply hacking a software with just basic understanding of Assembly. All you need is Olly dbg(v 1.10) and Winrar(any version).
Our target is to bypass the registration screen which is like above figure.
STEP 1 : Run olly dbg and open winrar in it by dragging it and dropping it in olly dbg.
STEP 2 : Now right click on the CPU main thread module and go to Search For > All Referenced text String
A new process containing all the reference stings will open
STEP 3 : A right click on this new window and click on Search for text STEP 5 : Search for "reminder" in the search box as shown in the figure
STEP 5 : On pressing enter you will reach to the particular string location .
STEP 6 : Now double click it (reminder) and you will be taken to the main thread location of the string "reminder".
STEP 7 : So now you have reached to the location that is responsible for generating the particular reminder message that pops up every-time we start winrar. Now from here you will need a basic understanding of Assembly.
STEP 8 : Upon careful analysis of the region around the "reminder" text you will find a statement similar to this " JE SHORT winrar.00441219 " . "JE" means "jump if equals". This means that if your copy of winrar is already a registered copy then this statement will prevent the execution of the reminder message. So what shold we do here so that it still doesn't display the reminder even though we have an unregistered copy of winrar.
STEP 9 : Go to the jump statement and double click it. Now change "JE SHORT winrar.00441219" to " JMP SHORT winrar.0041219 " .
STEP 10: Save changes to the executable to see if you have performed the RE process correctly
STEP 11: All you need to do now is go to the CPU main thread module , right click > copy to executable > all modifications. Press yes for the alert messages. You can either save it with the same name as winrar.exe to over-right the previous file or you can first save it with a different name to check if you have succeeded
Once you are done with the saving part , you can now run the executable. If everything is right then you will not find any alert message this time.
:D Enjoy :D
NOTE : FOR EDUCATIONAL PURPOSES ONLY. I AM NOT RESPONSIBLE FOR THE CONSEQUENCES.
[via]If you enjoyed this post, make sure you subscribe to my RSS feed! Comments are encouraged
STEP 1 : Run olly dbg and open winrar in it by dragging it and dropping it in olly dbg.
STEP 2 : Now right click on the CPU main thread module and go to Search For > All Referenced text String
A new process containing all the reference stings will open
STEP 3 : A right click on this new window and click on Search for text STEP 5 : Search for "reminder" in the search box as shown in the figure
STEP 6 : Now double click it (reminder) and you will be taken to the main thread location of the string "reminder".
STEP 7 : So now you have reached to the location that is responsible for generating the particular reminder message that pops up every-time we start winrar. Now from here you will need a basic understanding of Assembly.
STEP 8 : Upon careful analysis of the region around the "reminder" text you will find a statement similar to this " JE SHORT winrar.00441219 " . "JE" means "jump if equals". This means that if your copy of winrar is already a registered copy then this statement will prevent the execution of the reminder message. So what shold we do here so that it still doesn't display the reminder even though we have an unregistered copy of winrar.
STEP 9 : Go to the jump statement and double click it. Now change "JE SHORT winrar.00441219" to " JMP SHORT winrar.0041219 " .
STEP 10: Save changes to the executable to see if you have performed the RE process correctly
STEP 11: All you need to do now is go to the CPU main thread module , right click > copy to executable > all modifications. Press yes for the alert messages. You can either save it with the same name as winrar.exe to over-right the previous file or you can first save it with a different name to check if you have succeeded
Once you are done with the saving part , you can now run the executable. If everything is right then you will not find any alert message this time.
:D Enjoy :D
NOTE : FOR EDUCATIONAL PURPOSES ONLY. I AM NOT RESPONSIBLE FOR THE CONSEQUENCES.
[via]If you enjoyed this post, make sure you subscribe to my RSS feed! Comments are encouraged
