Hacking mac apps: Direct Mail

Search

My name is Kenneth and I write cool Mac and iPhone software. This is my personal weblog where I post about stuff I find interesting. I usually write about Mac development, the business of shareware and the Mac community in general.

October 2008

September 2008

[NSBlog date:@"19 December 2007"].comments = 5;

In this post, I will describe how to hack a mac shareware app.

The reason for this is to push the developers to create stronger protection, and to show common weaknesses in licensing code.

Before each hack is published, I get the concerned developer’s approval, and send them a note describing the hack, and suggesting ways to improve their protection. I also leave them some time to patch their app before I publish the hack.

I have no intention of promoting piracy, and this not meant to be used as a guide for would-be pirates to get those for free. What follows if of highly technical nature, and is intended for fellow developers.

Today is up: Direct Mail, a great app from e3 software useful for anyone doing mailing lists or press releases.

I did this hack on version 1.8.3, because it isn’t the latest.

First thing to do, is to class-dump the executable, which results in an interesting find:

@interface CAppDelegate : NSObject
{
    BOOL _registered;   // 4 = 0×4
    NSString *_registeredName;  // 8 = 0×8
    SUUpdater *sparkleUpdater;  // 12 = 0xc
}

+ (id)sharedDelegate;
+ (void)applyIconsToChangeStatusMenu:(id)fp8;
- (id)init;
- (BOOL)registered;
- (id)registeredName;
- (void)setRegisteredName:(id)fp8;
- (BOOL)validateMenuItem:(id)fp8;
- (void)loadRegistration;
- (BOOL)isValidCode:(id)fp8 forName:(id)fp12;
- (void)saveRegistrationCode:(id)fp8 forName:(id)fp12;
- (id)sparkleUpdater;
- (void)doPrefs:(id)fp8;
- (void)doRegister:(id)fp8;
- (void)doPurchase:(id)fp8;
- (BOOL)alertShowHelp:(id)fp8;
- (void)doAbout:(id)fp8;
- (void)doReportBug:(id)fp8;
- (void)doConnectionDoctor:(id)fp8;
- (void)openAppWebsite;
- (void)openRegisterWebsite;
- (void)runKRM;
- (id)lookupKagiAffiliate;
- (void)showPurchaseThankYou:(id)fp8;
- (void)showFirstRunAlert;
- (void)applicationWillFinishLaunching:(id)fp8;
- (void)applicationDidFinishLaunching:(id)fp8;
- (BOOL)crashReporterShouldDisplayException:(id)fp8;

@end

Now, there’s different ways to hack this. You could just edit the ivar _registered upon launch. Other option would be to hack registered or isValidCode:forName: to always return true.

I’m going to go with a slightly more complicated way, and hack the methods which call isValidCode:forName:.

Let’s set a breakpoint when isValidCode is called. Disassemble the whole thing, and check where isValidCode:forName: is called. For me, it returns at 0×00008fdc. Run. It hits the breakpoint immediately. Continue once, to let it finish its setting up etc. Now, using the app, go to the register menu and try to register (with a properly-formatted email-address). It will hit the breakpoint again. Do a nexti. You now are in “0×0002ffb7 in -[CRegisterPanelController doOK:] ()”

Let’s disassemble this method:

0x0002ff50 <-[CRegisterPanelController doOK:]+0>: push %ebp 0×0002ff51 <-[CRegisterPanelController doOK:]+1>: mov %esp,%ebp 0×0002ff53 <-[CRegisterPanelController doOK:]+3>: push %edi 0×0002ff54 <-[CRegisterPanelController doOK:]+4>: push %esi 0×0002ff55 <-[CRegisterPanelController doOK:]+5>: push %ebx 0×0002ff56 <-[CRegisterPanelController doOK:]+6>: sub $0×1c,%esp 0×0002ff59 <-[CRegisterPanelController doOK:]+9>: mov 0×8(%ebp),%edi 0×0002ff5c <-[CRegisterPanelController doOK:]+12>: mov 0×22091c,%eax 0×0002ff61 <-[CRegisterPanelController doOK:]+17>: mov %eax,0×4(%esp) 0×0002ff65 <-[CRegisterPanelController doOK:]+21>: mov 0×221fa4,%eax 0×0002ff6a <-[CRegisterPanelController doOK:]+26>: mov %eax,(%esp) 0×0002ff6d <-[CRegisterPanelController doOK:]+29>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002ff72 <-[CRegisterPanelController doOK:]+34>: mov %eax,%esi 0×0002ff74 <-[CRegisterPanelController doOK:]+36>: mov 0xc(%edi),%edx 0×0002ff77 <-[CRegisterPanelController doOK:]+39>: mov 0×221428,%eax 0×0002ff7c <-[CRegisterPanelController doOK:]+44>: mov %eax,0×4(%esp) 0×0002ff80 <-[CRegisterPanelController doOK:]+48>: mov %edx,(%esp) 0×0002ff83 <-[CRegisterPanelController doOK:]+51>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002ff88 <-[CRegisterPanelController doOK:]+56>: mov %eax,%ebx 0×0002ff8a <-[CRegisterPanelController doOK:]+58>: mov 0×8(%edi),%edx 0×0002ff8d <-[CRegisterPanelController doOK:]+61>: mov 0×221428,%eax 0×0002ff92 <-[CRegisterPanelController doOK:]+66>: mov %eax,0×4(%esp) 0×0002ff96 <-[CRegisterPanelController doOK:]+70>: mov %edx,(%esp) 0×0002ff99 <-[CRegisterPanelController doOK:]+73>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002ff9e <-[CRegisterPanelController doOK:]+78>: mov %ebx,0xc(%esp) 0×0002ffa2 <-[CRegisterPanelController doOK:]+82>: mov %eax,0×8(%esp) 0×0002ffa6 <-[CRegisterPanelController doOK:]+86>: mov 0×22084c,%eax 0×0002ffab <-[CRegisterPanelController doOK:]+91>: mov %eax,0×4(%esp) 0×0002ffaf <-[CRegisterPanelController doOK:]+95>: mov %esi,(%esp) 0×0002ffb2 <-[CRegisterPanelController doOK:]+98>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al 0×0002ffb9 <-[CRegisterPanelController doOK:]+105>: jne 0×2ffc7 <-[CRegisterPanelController doOK:]+119> 0×0002ffbb <-[CRegisterPanelController doOK:]+107>: add $0×1c,%esp 0×0002ffbe <-[CRegisterPanelController doOK:]+110>: pop %ebx 0×0002ffbf <-[CRegisterPanelController doOK:]+111>: pop %esi 0×0002ffc0 <-[CRegisterPanelController doOK:]+112>: pop %edi 0×0002ffc1 <-[CRegisterPanelController doOK:]+113>: pop %ebp 0×0002ffc2 <-[CRegisterPanelController doOK:]+114>: jmp 0×21f444 <dyld_stub_NSBeep> 0×0002ffc7 <-[CRegisterPanelController doOK:]+119>: mov 0×22091c,%eax 0×0002ffcc <-[CRegisterPanelController doOK:]+124>: mov %eax,0×4(%esp) 0×0002ffd0 <-[CRegisterPanelController doOK:]+128>: mov 0×221fa4,%eax 0×0002ffd5 <-[CRegisterPanelController doOK:]+133>: mov %eax,(%esp) 0×0002ffd8 <-[CRegisterPanelController doOK:]+136>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002ffdd <-[CRegisterPanelController doOK:]+141>: mov %eax,%esi 0×0002ffdf <-[CRegisterPanelController doOK:]+143>: mov 0xc(%edi),%edx 0×0002ffe2 <-[CRegisterPanelController doOK:]+146>: mov 0×221428,%eax 0×0002ffe7 <-[CRegisterPanelController doOK:]+151>: mov %eax,0×4(%esp) 0×0002ffeb <-[CRegisterPanelController doOK:]+155>: mov %edx,(%esp) 0×0002ffee <-[CRegisterPanelController doOK:]+158>: call 0×21f395 <dyld_stub_objc_msgSend> 0×0002fff3 <-[CRegisterPanelController doOK:]+163>: mov %eax,%ebx 0×0002fff5 <-[CRegisterPanelController doOK:]+165>: mov 0×8(%edi),%edx 0×0002fff8 <-[CRegisterPanelController doOK:]+168>: mov 0×221428,%eax 0×0002fffd <-[CRegisterPanelController doOK:]+173>: mov %eax,0×4(%esp) 0×00030001 <-[CRegisterPanelController doOK:]+177>: mov %edx,(%esp) 0×00030004 <-[CRegisterPanelController doOK:]+180>: call 0×21f395 <dyld_stub_objc_msgSend> 0×00030009 <-[CRegisterPanelController doOK:]+185>: mov %ebx,0xc(%esp) 0×0003000d <-[CRegisterPanelController doOK:]+189>: mov %eax,0×8(%esp) 0×00030011 <-[CRegisterPanelController doOK:]+193>: mov 0×220788,%eax 0×00030016 <-[CRegisterPanelController doOK:]+198>: mov %eax,0×4(%esp) 0×0003001a <-[CRegisterPanelController doOK:]+202>: mov %esi,(%esp) 0×0003001d <-[CRegisterPanelController doOK:]+205>: call 0×21f395 <dyld_stub_objc_msgSend> 0×00030022 <-[CRegisterPanelController doOK:]+210>: movl $0×219530,0×8(%esp) 0×0003002a <-[CRegisterPanelController doOK:]+218>: mov 0×220784,%eax 0×0003002f <-[CRegisterPanelController doOK:]+223>: mov %eax,0×4(%esp) 0×00030033 <-[CRegisterPanelController doOK:]+227>: mov 0×221fb4,%eax 0×00030038 <-[CRegisterPanelController doOK:]+232>: mov %eax,(%esp) 0×0003003b <-[CRegisterPanelController doOK:]+235>: call 0×21f395 <dyld_stub_objc_msgSend> 0×00030040 <-[CRegisterPanelController doOK:]+240>: mov 0×220780,%edx 0×00030046 <-[CRegisterPanelController doOK:]+246>: mov %edx,0×4(%esp) 0×0003004a <-[CRegisterPanelController doOK:]+250>: mov %eax,(%esp) 0×0003004d <-[CRegisterPanelController doOK:]+253>: call 0×21f395 <dyld_stub_objc_msgSend> 0×00030052 <-[CRegisterPanelController doOK:]+258>: mov 0×4(%edi),%edx 0×00030055 <-[CRegisterPanelController doOK:]+261>: mov 0×220900,%eax 0×0003005a <-[CRegisterPanelController doOK:]+266>: mov %eax,0xc(%ebp) 0×0003005d <-[CRegisterPanelController doOK:]+269>: mov %edx,0×8(%ebp) 0×00030060 <-[CRegisterPanelController doOK:]+272>: add $0×1c,%esp 0×00030063 <-[CRegisterPanelController doOK:]+275>: pop %ebx 0×00030064 <-[CRegisterPanelController doOK:]+276>: pop %esi 0×00030065 <-[CRegisterPanelController doOK:]+277>: pop %edi 0×00030066 <-[CRegisterPanelController doOK:]+278>: pop %ebp 0×00030067 <-[CRegisterPanelController doOK:]+279>: jmp 0×21f395 <dyld_stub_objc_msgSend>

We now are at this line: “0×0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al”

That, in the right, is assembly code. This is basically some kind of “if” statement. (a TEST followed by a JNE (jump if not equal)).

What interests me is the next line: “0×0002ffb9 <-[CRegisterPanelController doOK:]+105>: jne 0×2ffc7 <-[CRegisterPanelController doOK:]+119>”

If we just reverse this test (turn the JNE into a JE (jump if equal)), any invalid code will be considered valid, and vice-versa. Let’s examine the memory for this statement.

(gdb) x/x 0×0002ffb9 0×2ffb9 <-[CRegisterPanelController doOK:]+105>: 0xc4830c75

Now, I’m working on a intel machine. And for some dumb reason, every block of four bytes is inverted. What this means, is that the byte that interests me is the rightmost one: 0×75. This is what a JNE looks like. Do some more tests by setting breakpoints until you find a JE, and read the memory for it: you will find that a JE is 0×74.

Let’s test if our theory is correct by editing the memory live, before we edit it in the binary. Do the following:

(gdb) set {char}0×0002ffb9=0×74 (gdb) x/x 0×0002ffb9 0×2ffb9 <-[CRegisterPanelController doOK:]+105>: 0xc4830c74 (gdb) disassemble 0×0002ffb7 Dump of assembler code for function -[CRegisterPanelController doOK:]: […edited out…] 0×0002ff99 <-[CRegisterPanelController doOK:]+73>: call 0×21f395 0×0002ff9e <-[CRegisterPanelController doOK:]+78>: mov %ebx,0xc(%esp) 0×0002ffa2 <-[CRegisterPanelController doOK:]+82>: mov %eax,0×8(%esp) 0×0002ffa6 <-[CRegisterPanelController doOK:]+86>: mov 0×22084c,%eax 0×0002ffab <-[CRegisterPanelController doOK:]+91>: mov %eax,0×4(%esp) 0×0002ffaf <-[CRegisterPanelController doOK:]+95>: mov %esi,(%esp) 0×0002ffb2 <-[CRegisterPanelController doOK:]+98>: call 0×21f395 0×0002ffb7 <-[CRegisterPanelController doOK:]+103>: test %al,%al 0×0002ffb9 <-[CRegisterPanelController doOK:]+105>: je 0×2ffc7 <-[CRegisterPanelController doOK:]+119> 0×0002ffbb <-[CRegisterPanelController doOK:]+107>: add $0×1c,%esp 0×0002ffbe <-[CRegisterPanelController doOK:]+110>: pop %ebx 0×0002ffbf <-[CRegisterPanelController doOK:]+111>: pop %esi 0×0002ffc0 <-[CRegisterPanelController doOK:]+112>: pop %edi 0×0002ffc1 <-[CRegisterPanelController doOK:]+113>: pop %ebp 0×0002ffc2 <-[CRegisterPanelController doOK:]+114>: jmp 0×21f444 0×0002ffc7 <-[CRegisterPanelController doOK:]+119>: mov 0×22091c,%eax […edited out…] End of assembler dump. (gdb)

Here we change the byte for the JNE, then test if we changed it correctly by re-reading it.

Then we disassemble the whole method again to see if the JNE was changed correctly. And yes — tah-da — it now says JE. Perfect. Continue. You are now registered. To make this change permanent: do “x/8x 0×0002ffb9″. You will get 24 bytes of data. Open the binary in your favorite hex editor and find the bytes outputted by gdb. If you’re on intel, don’t forget you have to reverse all the blocks of four bytes before searching. When you find it, edit the 0×75 into 0×74. Bravo! You have now made the change permanent.

We are not finished yet. As you will now notice if you run the program, it makes your code valid, but you get an error message each launch, and you have to re-do the entering a code process every time. This is because the first check at launch doesn’t happen in doOk:.

Continue and quit normally (using cmd-Q in Direct Mail). Launch it again by doing run. But this time, don’t continue after hitting the breakpoint at launch. Do nexti. Ok, so now we are in loadRegistration. Disassemble this method. Similarly, there’s a JE this time, just after the call to isValidCode:forName: Turn this into a JNE by changing the 0×74 into a 0×75 at this location in memory. If you disassemble the method again, you can see that the JE turned into a JNE. Like before, change this in the binary.

Well Done! You have now fully hacked Direct Mail 1.8.3.

By now, the developer has probably fixed this security flaw, so you can’t use this to get this app for free. If you like it, buy it. It’s a great piece of software! Think about the poor developers who have to feed their family.

You can download the trial version here

This entry was posted on Wednesday, December 19th, 2007 at 1:02 am and is filed under Apple, Cocoa, English, Hacking. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

Add your thoughts!

5 Comments

Seras Victoria states

September 13th, 2008 at 6:03 pm

When you say, “If you’re on intel, don’t forget you have to reverse all the blocks of four bytes before searching”, I assume you mean that when you disassemble the PPC code, which should be different (e.g. you’re not dealing with 0×75/0×74 at all, but something completely different), that whatever it is that you’ll get from gdb you do not reverse?

kenneth screams

September 13th, 2008 at 6:47 pm

Yeah: this is due to Intel being Little-endian, while PPCs are Big-endian. See http://en.wikipedia.org/wiki/Endianness#Little-endian for a more detailed explanation.

Seras Victoria pronounces

September 13th, 2008 at 11:01 pm

Well yes that makes sense, but I’m still a little confused… specifically when you said: “If you’re on intel, don’t forget you have to reverse all the blocks of four bytes before searching.”

In your example gdb gave you 0xc4830c75 for the instruction (right?), based on my somewhat limited knowledge I’m guessing that the 0×75 is the opcode that you want to change. So what is the value that’s searched for in the binary? Does gdb always spit out big endian instructions…?

kenneth exclaims

September 13th, 2008 at 11:21 pm

From my limited understanding of it yes. Basically, if you’re on intel, you’d read this in gdb: 0xc4830c75 and you’d have to search for this in the binary: 0×750c83c4. On PPC you’ll search for whatever you get in gdb. Note I don’t really know the full theory behind it, I just apply it in practice and this is what works for me.

Seras Victoria hums

September 16th, 2008 at 3:04 am

Thanks! I find this all fascinating and wish I had more time to study it (don’t worry, not because I want to steal any money from poor independent developers). Great post!

Hacking mac apps: Direct Mail

Search

Have something to say?