Main | Index

Flash Cap v1.2 Build 163 - Armadillo

Type : Flash Capture Utility
Protection : Armadillo
Tech Used : Virus Technology

Crack :

Thanks to Staier and Uncle Van for their wonder full tutorial on CreateTHread and Ring0 API ..And to all Virus writers for teaching me how to hook API

Armadillo : Commercial protection to safeguard your software. Realy it have good encryption engines ... but they are humans not GOD to make perfect thing.It some how watermarks SYSTEM.DAT and USER.DAT files to store our 30Day Trial period ... if you replace these files with backup copies you can get your 30 Day Trial back.
I think it is using some undocumented keys invisible to RegMon and RegEdit.

Flash Cap : Main file is "FCShare.dll" protected by Armadillo. InternetExplorer loads this dll ... so we can't make any loader stuff .. we must some how patch it so that Armadilo doesn't detect our patch.Main problem is that patch data is only available to us after unpacking.So we must hook some APis...best one is VirtualProtect. This crack is working on my pc [ Win98 ]

Special Note to Armadillo programers : You $%#$%^! ,you have no right
to control my PC ... which is my private property.Kick Ass $%^$#%!

About Box : In Flash Cap

Main Reg Check

String --- "Unregisted Copy"

BPX LOADSTRINGA

FCSHARE!.text

015F:60084565 E856480100 CALL 60098DC0 <--- Main Reg check
015F:6008456A 8B9C2420060000 MOV EBX,[ESP+00000620]
015F:60084571 8B2DF0630A60 MOV EBP,[USER32!GetDlgItem]
015F:60084577 83C408 ADD ESP,08
015F:6008457A 85C0 TEST EAX,EAX ----> Make EAX = 01
015F:6008457C 0F859A000000 JNZ 6008461C ---> Good Boy
.....................................................
015F:600845DE 56 PUSH ESI
015F:600845DF FF1558640A60 CALL [USER32!LoadStringA]
015F:600845E5 56 PUSH ESI
015F:600845E6 FF1558620A60 CALL [600A6258]

Inside CALL 60098DC0

015F:60098DD8 B0FF MOV AL,FF
015F:60098DDA 8BFF MOV EDI,EDI
015F:60098DDC 0AC0 OR AL,AL
015F:60098DDE 742E JZ 60098E0E <--- BAD BOY - OffSet = F2EE
015F:60098DE0 8A06 MOV AL,[ESI]
015F:60098DE2 46 INC ESI
015F:60098DE3 8A27 MOV AH,[EDI]
015F:60098DE5 47 INC EDI
015F:60098DE6 38C4 CMP AH,AL
015F:60098DE8 74F2 JZ 60098DDC <--- BAD BOY - OffSet = F2F8
015F:60098DEA 2C41 SUB AL,41
015F:60098DEC 3C1A CMP AL,1A
..................................................
015F:60098E02 02C1 ADD AL,CL
015F:60098E04 0441 ADD AL,41
015F:60098E06 38E0 CMP AL,AH
015F:60098E08 74D2 JZ 60098DDC <--- BAD BOY - OffSet = F318
015F:60098E0A 1AC0 SBB AL,AL
015F:60098E0C 1CFF SBB AL,FF
015F:60098E0E 0FBEC0 MOVSX EAX,AL
015F:60098E11 EB78 JMP 60098E8B

Patch : [Patching is not at all neccessary ... there is another way ....]

NOP all JZ ...

015F:60098E0A 33 C0 XOR EAX,EAX - OffSet = F31A

Another Simple way without applying above patch is that [600AD284] points to "DEFAULT". Change any letter and you are registered ...? Crazy ... Big Loop Hole ?

Expired Nag Box At StartUp :

015F:00C3D788 E8ACE3FFFF CALL 00C3BB39
015F:00C3D78D 84C0 TEST AL,AL
015F:00C3D78F 59 POP ECX
015F:00C3D790 7441 JZ 00C3D7D3
015F:00C3D792 385D08 CMP [EBP+08],BL
015F:00C3D795 7523 JNZ 00C3D7BA <--- Good Boy
015F:00C3D797 A1241EC500 MOV EAX,[00C51E24]
015F:00C3D79C 389810060000 CMP [EAX+00000610],BL
015F:00C3D7A2 7516 JNZ 00C3D7BA
015F:00C3D7A4 682CBFC400 PUSH 00C4BF2C
015F:00C3D7A9 E83CE3FFFF CALL 00C3BAEA
015F:00C3D7AE C704242F050000 MOV DWORD PTR [ESP],0000052F
015F:00C3D7B5 E9BA000000 JMP 00C3D874
015F:00C3D7BA 6824BFC400 PUSH 00C4BF24
015F:00C3D7BF 68D8B1C400 PUSH 00C4B1D8
015F:00C3D7C4 E8046EFFFF CALL 00C345CD
015F:00C3D7C9 682CBFC400 PUSH 00C4BF2C
015F:00C3D7CE E9C2000000 JMP 00C3D895

Fix :

015F:00C3D788 E8ACE3FFFF CALL 00C3BB39
015F:00C3D78D 84C0 TEST AL,AL
015F:00C3D78F 59 POP ECX
015F:00C3D790 EB28 JMP 00C3D7BA <---

Virtual Protect -- API Used by Armadilo to change Protection

015F:00C40097 8D8544FEFFFF LEA EAX,[EBP-01BC]
015F:00C4009D 50 PUSH EAX
015F:00C4009E FFB544FEFFFF PUSH DWORD PTR [EBP-01BC]
015F:00C400A4 FFB54CFEFFFF PUSH DWORD PTR [EBP-01B4]
015F:00C400AA 8B856CFEFFFF MOV EAX,[EBP-0194]
015F:00C400B0 038548FEFFFF ADD EAX,[EBP-01B8]
015F:00C400B6 50 PUSH EAX
015F:00C400B7 FF152491C400 CALL [KERNEL32!VirtualProtect]
015F:00C400BD 8B8550FEFFFF MOV EAX,[EBP-01B0]
015F:00C400C3 8985B4ECFFFF MOV [EBP+FFFFECB4],EAX

SICE Detection:

015F:00C400B6 50 PUSH EAX
015F:00C400B7 FF152491C400 CALL [KERNEL32!VirtualProtect]
015F:00C400BD 8B8550FEFFFF MOV EAX,[EBP-01B0]
015F:00C400C3 8985B4ECFFFF MOV [EBP+FFFFECB4],EAX
015F:00C400C9 FFB5B4ECFFFF PUSH DWORD PTR [EBP+FFFFECB4]
015F:00C400CF E8F8240000 CALL 00C425CC
015F:00C400D4 59 POP ECX
015F:00C400D5 E94DFDFFFF JMP 00C3FE27
015F:00C400DA 8325041EC50000 AND DWORD PTR [00C51E04],00
015F:00C400E1 66C78558FEFFFF7546 MOV WORD PTR [EBP-01A8],4675
015F:00C400EA 66C74590F3B5 MOV WORD PTR [EBP-70],B5F3
015F:00C400F0 C745FC01000000 MOV DWORD PTR [EBP-04],00000001
015F:00C400F7 B900000000 MOV ECX,00000000
015F:00C400FC 668CC9 MOV CX,CS
015F:00C400FF 32C9 XOR CL,CL
015F:00C40101 E361 JECXZ 00C40164
015F:00C40103 B443 MOV AH,43
015F:00C40105 CD68 INT 68 <----
015F:00C40107 66338558FEFFFF XOR AX,[EBP-01A8]
015F:00C4010E 663B4590 CMP AX,[EBP-70]
015F:00C40112 7550 JNZ 00C40164

EAX=601105B3 ; [EBP-70] = SS:0058B30C=B5F3

UnPacking :

BPMB #0030:00C3D79C W DR3

FCShare.text1

015F:600BD511 50 PUSH EAX
015F:600BD512 8B47F8 MOV EAX,[EDI-08]
015F:600BD515 0345FC ADD EAX,[EBP-04]
015F:600BD518 50 PUSH EAX
015F:600BD519 E8D20B0000 CALL 600BE0F0 <--- Unpack
015F:600BD51E 83C728 ADD EDI,28
015F:600BD521 83C40C ADD ESP,0C
015F:600BD524 8D47EC LEA EAX,[EDI-14]
015F:600BD527 3BC3 CMP EAX,EBX
015F:600BD529 72DE JB 600BD509
015F:600BD52B 8B7DFC MOV EDI,[EBP-04]
015F:600BD52E 3B7DF4 CMP EDI,[EBP-0C]
015F:600BD531 7423 JZ 600BD556 <--- Loop
015F:600BD533 8B86A0000000 MOV EAX,[ESI+000000A0]
015F:600BD539 FFB6A4000000 PUSH DWORD PTR [ESI+000000A4]
015F:600BD53F 03C7 ADD EAX,EDI
015F:600BD541 50 PUSH EAX
015F:600BD542 FF75F4 PUSH DWORD PTR [EBP-0C]
015F:600BD545 57 PUSH EDI
015F:600BD546 E8D8000000 CALL 600BD623
015F:600BD54B 83C410 ADD ESP,10
015F:600BD54E 84C0 TEST AL,AL
015F:600BD550 0F84C9000000 JZ 600BD61F ---> Ex