While browsing around http://www.apple.com/downloads to check for any interesting software (I really like the Featured 3rd party and latest software sections) I found this well designed CD burning app, Disco (http://www.discoapp.com).
I really like their website design (I have a big passion for design although I can’t design anything myself) and decided to try their app since it fits two characteristics, well designed interface and a software protection! Hurray.
Open it, bang, Little Snitch warns about connection attempt and a nice registration dialogue appears. Try to input some name and some serial, press register, nothing happens! Hummmm it seems we might have a challenge here!
Next step before loading the all mighty GDB and otx is to look at Contents/Resources folder and check out the NIB for this registration screen. One file calls my attention: registration_successful.aif.
So what can we try? Disassemble main binary with otx and search for registration_successful. Bang we have an hit!
-(void)[DCPreferencesController doRegister:]
(...)
0002b522 8b1544500400 movl 0x00045044,%edx validateName:andCode:
0002b528 890424 movl %eax,(%esp,1)
0002b52b 89542404 movl %edx,0x04(%esp,1)
0002b52f e84c1d0200 calll 0x0004d280 -[(%esp,1) validateName:andCode:] <- CRACKME
0002b534 84c0 testb %al,%al
0002b536 7453 je 0x0002b58b
0002b538 c7442408fc3a0400 movl $0x00043afc,0x08(%esp,1) registration_successful
0002b540 a1ac580400 movl 0x000458ac,%eax soundNamed:
(...)
And that’s it, game over… We have an entry point. Test it by loading into GDB, bypass that jump and voila, Thank you for registering….
If we load again the program, it’s still not registered but that’s not what I’m looking after here. Entrypoint is found and game is over! No challenge here but a good example of why simple details matter to defeat protections.
Is there any equivalent to GetWindowTextA (and friends) in Cocoa? Can we breakpoint on text input? How? It’s possible to check the NIB but that’s not always available.
Btw, check this other app from the same company, http://www.versionsapp.com. If you use SVN it looks like a killer app (I use Mercurial).