Cheat Engine

Cryoma · Posted: Thu Oct 06, 2011 1:00 am Post subject: Program isolation?

Ok so I have this program that requires a key on startup, which is checked against a server.
Your IP and CPUID are logged with that key to prevent sharing.
How can I freeze this program to work without connecting to the server?

Aviar³ · Posted: Thu Oct 06, 2011 1:22 am Post subject:

Seems solid. Id think youd have to patch its executable, but I wouldnt know where to start (other than OllyDbg). Also the logic behind what Im thinking is that you cant effectively isolate it or simulate the communication with the server, so you need to make it jump directly to the authentication succeeded portion of the code. Though, this too is probably wrong if the server returns a key for decrypting anything.

Cryoma · Posted: Thu Oct 06, 2011 3:30 am Post subject:

sjirshoij I have no idea how to use olley.

M.CORP · Posted: Thu Oct 06, 2011 3:50 am Post subject:

http://tuts4you.com/download.php?list.17

Aviar³ · Posted: Thu Oct 06, 2011 10:58 am Post subject:

Better off asking someone like x0r, or Wiccan.

Slugsnack · Posted: Thu Oct 06, 2011 2:39 pm Post subject:

It's not solid lol. You can spoof IP, CPUID as well as potentionally the reply from the server. You could potentially even patch it to work without authentication with enough reversing.

Aviar³ · Posted: Thu Oct 06, 2011 2:47 pm Post subject:

Slugsnack · Posted: Thu Oct 06, 2011 2:51 pm Post subject:

http://en.wikipedia.org/wiki/IP_address_spoofing

Depending how it works, the response might not be a direct reply to the source IP.

Cryoma · Posted: Thu Oct 06, 2011 2:52 pm Post subject:

I've seen localhost spoofing, you run a script that emulates a server response, but I have no idea how to make one of those.
For now I'm reading up on reversing, thanks for the tutorials.

Aviar³ · Posted: Thu Oct 06, 2011 2:58 pm Post subject:

Slugsnack · Posted: Thu Oct 06, 2011 3:06 pm Post subject:

I assumed he had a key. Additionally, there is nothing in the description indicating it contacts a server to get the key. Usually, you get a key from an email or from a hardware label.

You can not make assumptions off baseless guesses. Any assumptions I made are based off of experience and what generalisations I have made from all the reversing I've done in the past. I'm simply giving him options of things that can be done, not saying any of them by themselves may help him crack the program. If you study some topic such as network security and analyse the above with something like BAN logic, you'll realise it's not a 'solid' approach at all.

Most programs don't lock keys to IP/CPUID. At most they log them and look for suspicious behaviour.

Cryoma · Posted: Thu Oct 06, 2011 3:11 pm Post subject:

No I have a key, and yes it's just logged for suspicious behaviour.

elpacco · Posted: Thu Oct 06, 2011 4:29 pm Post subject:

http://www.r1ch.net/stuff/nonet/