5 ms·
Pretty interesting! I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks
by redbell 3y ago
Pretty interesting!
I believe being successful in reverse engineering, cracking, bypassing security layers (e.g., unlocking cars without keys), and other hacks comes down to understanding the basics of how these systems are designed to work in the first place. Add to this, the possession of the right toolbox to do the job.
Back in 2010, I took on the challenge of cracking paid/licensed POS software. I am, in no way, a cracker or hacker, but once I understood how this app works, I followed a simple logic based on these rules:
a. The app had a trial version with a number of *runs* set, and with each launch of the app, the number will decrease by one. It was set to around 100, I believe.
b. The app runs on a LAN, on multiple computers, with one being the server. To my surprise, there were no IP configurations, and it turned out that it worked on LAN by setting the app directory as a *shared folder* in Windows!!
c. On each app launch, even from other computers (having access to the shared folder), the count will decrease.
So, I started my investigation:
1. Since you have a shared folder, based on (c) above, I assumed the location where the count number is stored *must be inside* this shared folder, not in the Windows registry or other places.
2. I launched the app, wrote down the current count, and closed it.
3. I searched inside this shared folder for *.* (all files), then sorted them by last edited.
4. I picked the first one from the search result as it was the only one with the same time as *now*; it was in a binary format.
5. I opened it using a hex editor, converted (using calc.exe) to HEX the count I wrote down on (2), searched for it, and found it. I identified its position.
6. I closed the hex editor, repeated (2),(3) and (4), and got the same results.
7. Now, I typed 999 in calc.exe and converted it to HEX, and in the open HEX editor, I edited the count at its current position with the new value, saved, and closed the binary file.
8. Restarted the POS app, went to about, and.. booooom , it now thinks that you have 999 days remaining :)
Although I never used this Point of Sale software, it was an exciting achievement for me. I felt like a real hacker.
- shiroiushi 3y agoYou were a real hacker. That's exactly how a real hacker would have done it, starting from the simplest method of reverse-engineering, and moving to more difficult methods or complicated tools only as necessary. Luckily for you, this POS app wasn't very well-designed from a security standpoint, but that's not unusual, especially for software that has a very limited market and is written by a very small team.
- skeaker 3y agoSimilar story from me, I was digging around in the code of this game that I had been playing since I wanted to make mods for it. At one point I found the internal IDs for different outfits you can put on your characters which was relevant to what I was making, so I grepped for those IDs since they were one of the few strings that weren't jumbled by code obfuscation. Stumbled upon the code that checks if you own the DLC outfits and found out you could basically just swap the check for a return(true). You could even use them online... Hardly any protection at all but it hadn't been cracked simply because nobody else looked that closely.
- NoahKAndrews 2y agoFiles are allowed to not have extensions. Wouldn't just * been enough?