Palm Reversing - A live approach - by Latigo/UCF
Published by Tsehp September 2000.
Hi! My first palm reversing tutorial was focused on a dead-listing reversing approach. Now the technique used is a little bit different. We'll be using a debugger to get a serial out of Yearly and i'll also show you to make a KeyGen. Our target is 'Yearly'
|Tools used: IDA Disassembler,PalmDebugger,PalmEmulator (this two last can be downloaded from www.palm.com),PrcView (get it at my site :)|
We'll start by loading our app in the emulator or palm and trying to register it giving as serial any garbage. And all we get is 'You entered a wrong code!'. Sweet :) lets look for this string inside the Alert resources. Split the whole file with prcview (or any other similar tool of course) A little search shows us that the alert resource named 'Talt0x138d.bin' is the one that is fired when we enter a wrong serial. So lets search in IDA's dead listing the '138d' string.
code0001:000048B6 loc_0_48B6: code0001:000048B6 move.w 8(a0),d0 code0001:000048BA cmpi.w #$44D,d0 code0001:000048BE bne.s loc_0_48FA code0001:000048C0 move.l $A0C(a4),-(sp) code0001:000048C4 systrap FldGetTextPtr() <- get a Ptr to our serial code0001:000048C8 move.l a0,-(sp) <- push that Ptr now code0001:000048CA lea $560(a4),a0 <- load in A0 other pointer code0001:000048CE pea 2(a0) code0001:000048D2 systrap StrCopy() <- copy it! code0001:000048D6 bsr sub_0_5CC <- Jump to Reg Function code0001:000048DA adda.w #$C,sp <- Clean Stack code0001:000048DE tst.w $28(a4) <- RegFlag is 0? code0001:000048E2 beq.s loc_0_48EC <- JZ bad boy msg code0001:000048E4 move.w #$138C,-(sp) <- show good msg code0001:000048E8 bra loc_0_48F0 code0001:000048EC code0001:000048EC loc_0_48EC: code0001:000048EC move.w #$138D,-(sp) <-- HERE! code0001:000048F0 code0001:000048F0 loc_0_48F0: code0001:000048F0 systrap FrmAlert() code0001:000048F4 addq.w #2,sp code0001:000048F6 bra loc_0_4900
So after a little glance we find out that the scheme is the typical one. Call 'Reg' Function (000048D6), compare RegFlag (000048DE), JZ BadBoy (000048E2) or else show 'Thank you' Message (000048E4). Lets get inside the 'Reg' function now (not going to paste all the disassembly) The first thing i always do is just take a look at the whole function. I mean, a rapid glance to see how long it is and to check for the existance of any other API calls which might facilitate my work. At the end of this subroutine i find some juicy code:
code0001:000006BE loc_0_6BE: code0001:000006BE lea $560(a4),a0 code0001:000006C2 pea 2(a0) <- Pushes here the same ptr as in 000048CA code0001:000006C6 pea $2A0(a4) <- Address of the generated serial code0001:000006CA systrap StrCompare() <- beloved API which will be breakpointed :) code0001:000006CE tst.w d0 <- Are they the same? code0001:000006D0 bne.s loc_0_6D8 <- JNE Bad Boy code0001:000006D2 move.w #1,$28(a4) <- put 1 in the regflag code0001:000006D8 code0001:000006D8 loc_0_6D8: code0001:000006D8 movem.l var_18(a6),d3-d7/a2 <- pop registers (?) code0001:000006DE unlk a6 code0001:000006E0 rts <- RET
Time to 'live' reverse! What we are going to do now is
to put a breakpoint on the StrCompare SysTrap using the PalmDebugger. How
to do this? the command for 'breakpointing' on an API (set an a-trap) is 'ATB'.
So in PalmDebugger you must 'ATB ApiNumber' in
order to succesfully set a bpx. I must confess that i spent lots of days
looking for some API reference.. and in the end i found out that this same
list can be found in the PalmOs SDK. Anyway, i provide you with a nice and
comprehensible list here.
code0001:000006BE lea $560(a4),a0 code0001:000006C2 pea 2(a0) <- Pushes here the same ptr as in 000048CA code0001:000006C6 pea $2A0(a4) <- Address of the generated serial
We are interested in $2A0(A4) since the other one just
contains a copy of our serial.
0001330A: 35 36 36 38 00 00 00 00 00 00 00 00 00 00 00 00 "5668............"
Sweeet Baybeee! this is our serial :)