4 ms·

Quite often these checks are just so simple and half-hearted that once you have even a little experience they're obvious. A most basic protection, for example,

Quite often these checks are just so simple and half-hearted that once you have even a little experience they're obvious. A most basic protection, for example, might make the user enter a serial number to register a piece of software. If you enter the correct number then all is OK, if you enter the wrong number a message-box might appear saying "Sorry registration number is invalid". Displaying that message-box almost immediately makes the cracking job 80% simpler. Disassemble the program, look for the reference to the text-string. Then look for a "compare + jump" that goes to that area of the code. 99% of the time the comparison will be "Is the serial number OK?" and if you remove the jump, or invert it ("jmpz -> jumpnz"), you're done. If you want to read more you can find mirrors of +fravias documentation and demonstration site online which were live back in the day and introduce this stuff, and lots more: http://71.6.196.237/fravia/academy.htm http://71.6.196.237/fravia/academy.htm

ryanjshaw 12y ago
Almost all (?) protection ultimately requires some kind of feedback that you can work backwards from, so it was always a losing battle for developers. In a similar vein, I remember having the Grand Theft Auto 1 demo. Because it was an open world, it had a time limit on how long you could play the game. The countdown was displayed in red digits in the corner of the screen. I used SoftICE to set a memory write breakpoint on the video framebuffer at the location where the timer was displayed. That allowed me to locate the code printing out the timer. That in turn gave me the address of the timer variable, against which I set another memory breakpoint, which brought me to the routine that was counting down the timer. A 1 byte patch effectively disabled the timer and allowed me to play for hours.
spiritplumber 12y ago
Wow. I made dinner for Fravia and crew once. Basically they just showed up at my place, and I was so honored that I raided the pantry.
- stevekemp 12y ago
  I got into hacking/coding by virtual of wanting infinite lives for the games I played on my ZX Spectrum. That taught me all about reverse engineering, the R-register, copy protections and similar. Most of Fravias work was easily understandable, and pretty obvious, from that background. But he really was an interesting character and I was genuinely saddened to learn of his death. I wish I could have met him.
- wpietri 12y ago
  Somehow I had missed hearing of Fravia. For the curious, Wikipedia has a good article on him: http://en.wikipedia.org/wiki/Fravia http://en.wikipedia.org/wiki/Fravia
klez 12y ago
That was how I cracked WinRAR back in the days. Or better, I got rid of the annoying popup.
ddingus 12y ago
An early favorite of mine was the disk check in Ultima II. Origin used a bad sector to verify original disk scheme. Consumer drives could not make a bad sector, only firmware modified drives could, and I didn't have one at the time. Based on some successful cracks I did on the Apple ][, I started working through the code, only to find out they didn't check for a specific error, just an error. Upon seeing that, I restarted my Atari with the copied disk in the drive. Ataris made a beep for each sector loaded, which was very handy. About 19, or maybe it was 23 beeps later, I opened the drive door waited for the error, closed it, and the game worked just fine. No need for a HEX patch.

ryanjshaw 12y ago

Almost all (?) protection ultimately requires some kind of feedback that you can work backwards from, so it was always a losing battle for developers. In a similar vein, I remember having the Grand Theft Auto 1 demo. Because it was an open world, it had a time limit on how long you could play the game. The countdown was displayed in red digits in the corner of the screen. I used SoftICE to set a memory write breakpoint on the video framebuffer at the location where the timer was displayed. That allowed me to locate the code printing out the timer. That in turn gave me the address of the timer variable, against which I set another memory breakpoint, which brought me to the routine that was counting down the timer. A 1 byte patch effectively disabled the timer and allowed me to play for hours.

spiritplumber 12y ago

Wow. I made dinner for Fravia and crew once. Basically they just showed up at my place, and I was so honored that I raided the pantry.

stevekemp 12y ago
I got into hacking/coding by virtual of wanting infinite lives for the games I played on my ZX Spectrum. That taught me all about reverse engineering, the R-register, copy protections and similar. Most of Fravias work was easily understandable, and pretty obvious, from that background. But he really was an interesting character and I was genuinely saddened to learn of his death. I wish I could have met him.
wpietri 12y ago
Somehow I had missed hearing of Fravia. For the curious, Wikipedia has a good article on him: http://en.wikipedia.org/wiki/Fravia http://en.wikipedia.org/wiki/Fravia

klez 12y ago

That was how I cracked WinRAR back in the days. Or better, I got rid of the annoying popup.

ddingus 12y ago

An early favorite of mine was the disk check in Ultima II. Origin used a bad sector to verify original disk scheme. Consumer drives could not make a bad sector, only firmware modified drives could, and I didn't have one at the time. Based on some successful cracks I did on the Apple ][, I started working through the code, only to find out they didn't check for a specific error, just an error. Upon seeing that, I restarted my Atari with the copied disk in the drive. Ataris made a beep for each sector loaded, which was very handy. About 19, or maybe it was 23 beeps later, I opened the drive door waited for the error, closed it, and the game worked just fine. No need for a HEX patch.