HOW TO CRACK, by +ORC, A TUTORIAL

---------------------------------------------------------------------------

LESSON C (1) - How to crack, Cracking as an art

---------------------------------------------------------------------------

[BARCODES] [INSTANT ACCESS]

--------------------------------------

[BARCODES]

First of all, let me stress the importance of cracking in

our everyday life. Cracking it's not just about software, it's

about information, about all patterns of life. To crack is to

refuse to be controlled and used by others, to crack is to be

free. But you must also be yourself free from petty conventions

in order to crack properly.

You must learn to discerne cracking possibilities all around

yourself, and believe me, the development of this ghastly society

brings every day new codes, protections and concealing

mechanismes.

All around us grows a world of codes and secret and not so

secret patterns. Codes that are at times so familiar and common

that we do not even notice them any more... and yet they are

there to fool us, and yet they offer marvellous cracking

possibilities.

Let's take as an striking example BARCODES... those little

lines that you see on any book you buy, on any bottle you get,

on any item around you... do you know how they work? If you do

not you may be excused, but you cannot be excused if you never

had the impulse to understand them... crackers are curious by

nature... heirs of an almost extinct race of researchers that has

nothing in common with the television slaves and the publicity

and trend zombies around us. Cracker should always be capable of

going beyond the obvious, seek knowledge where others do not see

and do not venture.

[BARCODE HISTORY]

Let's begin with a little history. Universal Product Code

(UPC) was adopted for commercial use by the grocery industry in

the USA. Among the advantages were a rapid, accurate and reliable

way of entering stock information into a computer and the

possibility to sack a lot of workers and to do more profit. The

early success led to the development of the European Article

Numbering System (EAN), a symbology similar to UPC, that is

widely used in Europe and in the rest of the World. I'll teach

you to crack this one, since I do not -fortunately- live in the

States. Keep in mind, anyway, that there are different barcode

symbologies, each with its own particular pattern of bars. The

UPC/EAN code used on retail products is an all-numeric code; so

is the Interleaved 2 of 5 Code. Code 39 includes upper case

letters, digits, and a few symbols. Code 128 includes every

printable and unprintable ASCII character code. The most new one

is a 2-D code. These are special rectangular codes, called

stacked barcodes or matrix codes. They can store considerably

more information than a standard barcode. They require special

readers which cost more than a standard scanner. The practical

limit for a standard barcode depends on a number of factors, but

20 to 25 characters is an approximate maximum. For applications

that need more data, matrix codes are used. For example, the next

time you receive a package from United Parcel Service look for

a small square label with a pattern of dots and a small bullseye

in the centre. This is a MaxiCode label, and it is used by UPS

for automatic destination sortition.

The manufacturer's ID number on the barcode uniquely

identifies products. These numbers are managed by the Uniform

Code Council in Dayton, Ohio for the States and Canada and by the

EAN authority (Internationale Article Numbering Association) in

Bruxelles, for Europe and the rest of the World. The

manufacturer's ID number accounts for some digits of the code,

which leaves other digits to be assigned in any way the producer

wants. He provides retail outlets with a list of his products and

their assigned codes so that they can be entered in the cash

register system. Many codes are NOT on the products and are added

by the supermarkets on the fly, using an internal code schema

that may be non standard. Now it's enough... let's crack.

BARCODES are the only thing an automated casher needs to see

on a product to calculate its price and automatically catalogate

the sold merchandise... imagine (just imagine it :=) coz it would

be extremely illegal to act in this way) somebody would fasten

an adhesive home-made codebar label direct on the top of the

supermarket/mall/retail store label, say on a bottle of Pomerol

(that's a very good but unfortunately very expensive french

wine).

The new label would mean for the casher something like

"cheap wine from Bordeaux, France, cost so and so, everything

it's OK, do not worry"... do you think that anybody would come

to the idea that there is something wrong with the label, with

the bottle or with you? I have been codebaring for years and had

only once a problem, coz my printer was running out of ink and

the scanner in the supermarket could not read it... so what? Act

uninterested, always wear jackets of the utmost quality, shetland

pullovers and beautiful expensive shoes... (all articles that you

may codebar too, by the way), in this society appearance and look

count much more than substance and knowledge... LET'S USE THIS

TO OUR ADVANTAGE! Nobody will ever come to the idea that you may

actually really know the working of the scheme... coz codebar is

pretty complicated and not exactly exceptionally public. On the

Web there are a lot information about it, but most of them are

useless, unless you know how to search most of the time you'll

find only sentences like this one:

"The calculated check digit is the twelfth and final

digit in the U.P.C.code. It is calculated based on a

specific algorithm, and is necessary to ensure that

the number is read or key-entered correctly."

But good +ORC will now explain you everything you need to crack:

[THE 13 BAR "CODES"]

Each barcode label has 13 values, from #0 to #12 (that's the EAN

code, the UPC american one has only 12, from #0 to #11).

#0 and #1 indicate the origin of the product.

#2 to #11 give the article code

#12 (the last and 13th one) is a checksum value, that

verifies the validity of all the other numbers.

How is it calculated? #12 is calculated in 4 steps

VALUE A: You sum odd position numbers (#0+#2+#4+#6+#8+#10)

VALUE B: You sum even position numbers and multiply by 3

((#1+#3+#5+#7+#9+#11)*3)

VALUE C: You sum value A and value B

VALUE D: You mod value C (you divide by 10 and only keep

the remaining units, a very widespread checking scheme as

you'll see in the software part of this lesson)

If the result is not zero, you subtract it from 10.

Now look at a barcode label, get some books or other barcoded

items and *watch* it...

Bar codes are supposed to have "quiet zones" on either side of

the symbol. Quiet zones are blank areas, free of any printing or

marks,typically 10 times the width of the narrowest bar or space

in the bar code. Failure to allow adequate space on either side

of the symbol for quiet zones can make it impossible to read the

bar code.

On the barcode there are two "borders", left and right, and a

"middle" longer line. These three lines are longer than the

others and are used to "regulate" the scanner to whatever

dimension has been used for the barcode.

#0 dwells left of the first (left) border and has a special

meaning, the other 12 numbers are written "inside" the code and

are divided in two "groups" by the middle bar.

Each value is coded through SEVEN bars: black=1 and White=0.

These form two couples of "optic" bars of different widths.

We come now to the "magic" part: In order to bluff the

simpletons, barcode uses three different SETS of characters to

represent the values 0-9. This should make it impossible for you

to understand what's going on, as usual, in this society, slaves

should not need to worry with the real functioning of things.

Here are the graphic codes of the three graphic sets:

CODE A CODE B (XOR C) CODE C (NOT A)

0: 0001101 (13) 0100111 (39) 1110010 (114)

1: 0011001 (25) 0110011 (51) 1100110 (102)

2: 0010011 (19) 0011011 (27) 1101100 (108)

3: 0111101 (61) 0100001 (33) 1000010 (066)

4: 0100011 (35) 0011101 (29) 1011100 (092)

5: 0110001 (49) 0111001 (57) 1001110 (078)

6: 0101111 (47) 0000101 (05) 1010000 (080)

7: 0111011 (59) 0010001 (17) 1000100 (068)

8: 0110111 (55) 0001001 (09) 1001000 (072)

9: 0001011 (11) 0010111 (23) 1110100 (116)

Borders: 101

Centre: 01010

- The C graphic set is a "NOT A" graphic set.

- The B graphic set is a "XOR C" graphic set.

- each value has two couples of bars with different widths

Now watch some labels yourself... see the difference between the

numbers left and the numbers right? The first "half" of the

barcode is coded using sets A and B, the second "half" using set

C. As if that were not enough, A and B are used inside the first

"half" in a combination that varies and depends from value #0,

following 10 different patterns:

#1 #2 #3 #4 #5 #6

0 A A A A A A

1 A A B A B B

2 A A B B A B

3 A A B B B A

4 A B A A B B

5 A B B A A B

6 A B B B A A

7 A B A B A B

8 A B A B B A

9 A B B A B A

"Ah! Stupid buyer will never understand why the same values gives

different bars! Nothing is as reliable as barcodes!" :=)

Let's take as example the codebar for Martini Dry:

BARCODE: 8 0 00570 00425 7

Let's see: we have a 8 0 0 = booze

Then a 000570 as ABABBA and a 004257 as C

"Even" sum: 8+0+5+0+0+2 = 15 (even sum)

Then a 0+0+7+0+4+5= 16 and 16 *3 = 48 (odd sum)

Then a 15+48=63

63 === 3

10 - 3 = 7 = checksum

Pattern = 8 = ABABBA CCCCCC

OK, one more example: Osborne Windows programming series Volume

2 General purpose API functions (always here on my table)...

BARCODE: 9 7 80078 81991 9

Let's see: we have a 9 7 8 = book

Then a 780078 as ABBABA and a 819919 as C

"Even" sum: 9+8+5+8+8+4 = 42 (even sum)

Then a 7+1+5+2+4+4= 23 and 23 * 3 = 69 (odd sum)

Then a 42+69=111

111 === 1

10 - 1 = 9 = checksum

Pattern = 9 = ABBABA

Well... what's the point of all this?

The point, my pupils, is that who DOES NOT KNOW is taken along

on a boat ride, who KNOWS and LEARNS can use his knowledge in

order to try to beat blue and black the loathsome consumistic

oligarchy where we are compelled to live. Try it out for

yourself... if you crack correctly and wisely your supermarket,

mall and library bills will be cut to almost zero.

Write a small program to print whichever codebar you fancy

(or whichever your mall uses) in whichever size on whichever sort

of label you (or better your targets) fancy... it's quickly done

with Visualbasic or Delphy... but you'll not find much on the Web

Alternatively you could also write, as I did long ago, a short

c program in dos, using a modified upper char set... and there

you are, have labels... see the world.

A small word of caution... crack only ONE item at time and

try it out first with the SAME label for the same product... i.e.

the correct code for that item, but on your own label. If it goes

through your program works good, if not, nobody will ever be able

to harm you. Anyway it never happens anything, never: the bar

code reading equipments have great tolerance, coz the scanners

must be able to recognize barcodes that have been printed on many

different medias. You should choose labels similar to the ones

effectively used only in order not to arise human suspects, coz

for all the scanner itself cares, your label could be pink with

green stripes and with orange hand-written, numbers. Mind you,

we are still just academically imagining hypothetical situations,

coz it would be extremely illegal to act in such an inconsiderate

manner.

CRACKING POWER! It's true for barcodes, for Telecom bills,

for Compuserve accounts, for Amexco cards, for banking cheques

(do you know what MICR is? Magnetic Ink Character Recognition...

the stylized little printing on the lower left of new cheques...

there is a whole cracking school working on it), for registration

numbers... you name it, they develope it, we crack it...

Begin with barcodes: it's easy, nice and pretty useful! Live

in opulence, with the dignity and affluence that should always

distinguish real crackers. Besides... you should see the

assortment of 'Pomerols' in my "Cave-a-vin" :=)

[INSTANT ACCESS]

The (c) Instant access routines are a commercial protection

scheme used to "unlock" complete commercial applications that

have been encrypted on CD-

ROMs which are distributed (mostly) through reviews.

This is an ideal cracking target: it's commercial software,

complete, uncrippled and of (relatively) prominent quality, that

you can get in tons for the price of a coke. Obviously this kind

of protection represents an ideal subject for our lessons. This

fairly intricate protection scheme has not yet been cracked by

anybody that I am aware of, anyway not publicly, therefore it's

an ideal candidate for a "strainer" to my university. I'll teach

you here how to crack it in three lessons, C.1, C.2 and C.3. I warn

you... it's a difficult cracking session, and this protection

represents quite an intellectual challenge. But if you are

seriously interested in our trade you will enjoy these lessons

more than anything else.

This cracking is intended as an "assignment" for my +HCU

"cracking university": you'll find inside lessons C.1 and C.2 a

relatively deep "introduction" to Instant access cracking. This

will teach you a lot anyway, and spare you hours of useless

roaming around, bringing you straight to the cracking point. But

I'll release the third part of this session, with the complete

solution (lesson C.3) on the Web only in october 1996, not a day

before. All the students that would like to apply to the Higher

Cracking University, opening on the web 01/01/1997, should work

in July, August and September (three months is more than enough

time) on this assignment. They should crack completely the

instant access scheme and send me their solutions, with a good

documentation of their cracking sessions, before 30/09/1996

(WATCH IT! You can crack this scheme in -at least- three

different paths, be careful and choose the *best* one. WATCH IT!

Some of the informations) in lesson C.1 and C.2 are slightly incorrect:

check it!).

There are four possibilities:

1) The candidate has not found the crack or his solution is

not enough documented or not enough viable... the candidate

is therefore not (yet) crack-able, he will not be admitted

to the +HCU 1997 curses, better luck in 1998;

2) The cracking solution proposed by the candidate is not as

good as mine (you'll judge for yourself in october) but it

works nevertheless... he'll be admitted at the 1997

courses;

3) The cracking solution of the candidate is more or less

equal to mine, he'll be admitted, personally monitored, and

he'll get all the material he needs to crack on higher

paths;

4) The cracking solution of the candidate is better than mine,

he'll be admitted, get all the material he wishes and asked

to teach us as well as study with us: "homines, dum docent,

discunt".

[Cracking Instant access]

The user that wants to "unlock" a software application

protected with (c) Instant Access must enter first of all a

REGISTRATION number string, which through a series of

mathematical manipulations gives birth to a special "product"

code. On the basis of this "product code" the user is asked to

phone the commercial protectors (and pay) in order to get a

special "unlock code" that will allow him to decrypt the relevant

software.

This kind of "passnumber" protection routines are widely

used for software unlocking, BBS access, server access, backdoor

opening and many other protection schemes. We have already seen

password cracks in different lessons of this tutorial (in

particular Lessons 3.1 and 3.2 for DOS and Lessons 8.1, 8.2 and

9.1 for WIN) albeit on a more simplistic scale: there it did

mostly not matter very much *HOW* you passed the protection: once

passed, you could have access to the application. This is not the

case with (c) Instant Access. Face it: it's a little boring, but

important that you learn how to defeat intricate protection

routines (you'll meet them often in the next years) and I believe

that the following example will give you a "feeling" for the

right cracking approach.

In this case we must not only "crack" this protection scheme

but also study it thoroughly in order to achieve our blessed

aims. This is a very good exercise: reverse disassembling will

teach you a lot of little tricks that you'll be able to use in

your other future cracking sessions.

Instant access (c) is a exceptionally widespread protection

scheme, and it should be relatively easy for you to gather some

encrypted software that has been protected with this method...

*DO IT QUICKLY!!* After the Web publishing of this lessons (I am

sending C.1 to 8 pages and 4 usenet groups on 25/06/1996) this

protection is obviously as dead as a Dodo. The "Accessors" guys

will have to conceive something smarter if they want to keep

selling "protections" to the lamer producers of "big" software.

BTW, if you are reading this and are working for some

commercial "protection" company, consider the possibility to

double cross your masters! Deliver me anonymously all the future

projects you are working on! That will amuse me, speed up the

advent of a true altruistic society and earn you the respect of

the better part of humanity.

As I said, many "huge" application are still protected with

this "Instant access" system. I have personally bought at least

7 or 8 "second hand" CD-ROMs packed full with Microsoft, Lotus,

Norton, Symantec, you name it, applications all "protected"

through this crap. The cost of this bunch of CD-ROMs was the

equivalent of a bottle of Dry Martini, maybe less. The same

software is sold, unlocked, to zombies and lusers for ludicrous

amounts of money.

Never buy CD-ROMs magazines when they appear! Be cool! Buy

them two or three months after the publishing date! Buy

"remainders" or "second hand" CD-ROM magazines "at kilo price"...

Come to think of it, never buy *anything* when it appears or when

some (paid) advertiser tells you to... remember that "trends",

"vogues", "fashions" and "modes" are only different names for the

whips that drill and chain the dull-witted slaves of this

loathsome society: "clever crackers consider cool, crack cheap,

cheat customary culture" (a rhetorical figure: an "Alliteration".

To defend yourself learn rhetoric... it's a more powerful and

more useful weapon than Kung-fu).

The "triple" password protection routine in (c) Instant

Access is very interesting from a cracker point of view. It's a

relatively complex scheme: I'll teach you to crack it in two

phases: First of all you must find the "allowed" registration

code, the one that "ignites" the "product code". We must crack

and understand this re_code first if we want to crack the rest.

Just for the records, I am cracking here (c) Action Instant

access version 1.0 (CD-ROM found on a old copy of "Personal

Computer World" of August 1994, packed full with encrypted Lotus,

Symantec, Claris and Wordperfect applications. Just to be sure

I crosschecked my results with another CD-ROM which also has

applications protected with (c) Instant Access: Paragon

Publishing's PC OFFICE: the protection scheme remains the same).

I am focusing for this lesson on the cracking of the specific

protection for the encrypted Symantec's Norton Utilities v.8.0.

Please refer to the previous lessons for the basic

techniques used in order to find the protection routine inside

our babe... for "low" cracking purposes you -basically- type a

number (in this case, where the input gets 10 numbers, we'll use

"1212-1212-12"), do your search inside the memory (s 30:0

lffffffff "your_string") and then set memory breakpoints on all

the relevant memory locations till winice pops (I know, I know,

buddies... there are more effective ways... but hold your mouth:

for now we'll keep them among us: let's make things a little

harder for the protectionists who read this... Besides: the old

approach works here flawlessly). After getting the Registration

window on screen the Winice standard procedure is:

:task ; how

:heap IABROWSE ; where & what

:hwnd IABROWSE ; get the Winhandle

:bpx [winhandle] WM_GETTEXT ; pinpoint code

:bpx GetProcAddress ; in case of funny routines

:dex 0 ds:dx ; let's see their name

:gdt ; sniff the selectors

:s 30:0 lffffffff "Your_input_string" ; search in 4 giga data

:bpr [all memory ranges for your string that are above 80000000]

and so on. (continued in lesson C.2)

Well, that's it for this lesson, reader. Not all lessons of my

tutorial are on the Web.

You 'll obtain the missing lessons IF AND ONLY IF you mail

me back (via anon.penet.fi) with some tricks of the trade I may

not know that YOU discovered. Mostly I'll actually know them

already, but if they are really new you'll be given full credit,

and even if they are not, should I judge that you rediscovered them

with your work, or that you actually did good work on them,

I'll send you the remaining lessons nevertheless. Your

suggestions and critics on the whole crap I wrote are also

welcomed.

E-mail +ORC

+ORC an526164@anon.penet.fi