DEBUGGING PROCESS
=================
Grade: junior5
Tools
- IDA, SoftIce, Hiew
Intro
-----
The boys from Zeon created a nice driver to transfer a Word or Excel
doc into PDF. Like me writing a lot, I needed a PDF format to store
for those guys who don't want to worry about all doc-versions and
incompatability of their readers.
Just print the doc to a pdf via the printermenu is made that easy.
This one was a nice proggy to coop with. However reversing a driver is
some different from a dll or exe.
Remarks
-------
It seems that the install proggy have a problem to create the proper crc ;-)
The job
-------
1STH remove jump to nag-screen
pdfdrv95.drv
============
HIEW
CODE
0001539F: 837EFA02 cmp w,[bp][-0006],002 ;" "
000153A3: 7506 jne 0000153AB <-------- here
000153A5: 837EFC00 cmp w,[bp][-0004],000 ;" "
000153A9: 744F je 0000153FA <-------- like this
---------------------------------------------------------------------------------
HIEW
HEX
00015390: 04 68 10 02 68 2D 05 68 5E 05 9A 33 05 00 00 83 h h- h^ ▄3 Γ
000153A0: 7E FA 02 75 06 83 7E FC 00 74 4F 83 7E FA 01 75 ~╖ u Γ~│ tOΓ~╖ u
000153B0: 0B 83 7E FC 00 75 05 9A 12 6A E8 04 8B 46 FC 0B Γ~│ u ▄ j▐ ∩F│
---------------------------------------------------------------------------------
IDA
CODE
0D83:049E loc_D83_49E: ; CODE XREF: sub_D83_0+481 ^j
0D83:049E ; sub_D83_0+48D ^j
0D83:049E push seg dseg40
0D83:04A1 push offset unk_30A3_210
0D83:04A4 push seg dseg40
0D83:04A7 push offset unk_30A3_55E
0D83:04AA call LSTRCPY ; Call Procedure
0D83:04AF cmp [bp+var_6], 2 ; Compare Two Operands
0D83:04B3 jnz loc_D83_4BB ; Jump if Not Zero (ZF=0) << JUST LET IT JUMP..
0D83:04B5 cmp [bp+var_4], 0 ; Compare Two Operands
0D83:04B9 jz loc_D83_50A ; Jump if Zero (ZF=1) << TO THE SAME ADRESS AS THIS ONE
0D83:04BB
---------------------------------------------------------------------------------
Reverse jump to jump over nag-screen routines, by adress change.
Why ?
The register info doesn't mathers anymore -even when this proggy is registered- ;-)
---------------------------------------------------------------------------------
HIEW
CODE
0001539F: 837EFA02 cmp w,[bp][-0006],002 ;" "
000153A3: 7555 jne 0000153FA <-------- changed
000153A5: 837EFC00 cmp w,[bp][-0004],000 ;" "
000153A9: 744F je 0000153FA <-------- like this
---------------------------------------------------------------------------------
HIEW
CODE
00015390: 04 68 10 02 68 2D 05 68 5E 05 9A 33 05 00 00 83 h h- h^ ▄3 Γ
000153A0: 7E FA 02 75 55 83 7E FC 00 74 4F 83 7E FA 01 75 ~╖ uUΓ~│ tOΓ~╖ u
000153B0: 0B 83 7E FC 00 75 05 9A 12 6A E8 04 8B 46 FC 0B Γ~│ u ▄ j▐ ∩F│
---------------------------------------------------------------------------------
Comparing
original
00015390: 04 68 10 02 68 2D 05 68 5E 05 9A 33 05 00 00 83 h h- h^ ▄3 Γ
000153A0: 7E FA 02 75 06 83 7E FC 00 74 4F 83 7E FA 01 75 ~╖ u Γ~│ tOΓ~╖ u << here
-- --
000153B0: 0B 83 7E FC 00 75 05 9A 12 6A E8 04 8B 46 FC 0B Γ~│ u ▄ j▐ ∩F│
with
debugged
00015390: 04 68 10 02 68 2D 05 68 5E 05 9A 33 05 00 00 83 h h- h^ ▄3 Γ
000153A0: 7E FA 02 75 55 83 7E FC 00 74 4F 83 7E FA 01 75 ~╖ uUΓ~│ tOΓ~╖ u << here
-- --
000153B0: 0B 83 7E FC 00 75 05 9A 12 6A E8 04 8B 46 FC 0B Γ~│ u ▄ j▐ ∩F│
==================================================================================
2TH STEP
Removing Trial version text
This easy: load in to an hex-editor and replace with empty -nothing-
----------------------------------------------------------------------------------
-1-
00003100: 72 69 76 65 72 20 34 2E 30 00 20 54 72 69 61 6C river 4.0 Trial
00003110: 20 56 65 72 73 69 6F 6E 00 44 6F 63 75 43 6F 6D Version DocuCom
into
00003100: 72 69 76 65 72 20 34 2E 30 00 00 00 00 00 00 00 river 4.0
00003110: 00 00 00 00 00 00 00 00 00 44 6F 63 75 43 6F 6D DocuCom
-2-
00003DA0: 65 72 4D 61 72 6B 00 4D 79 47 65 74 4C 69 63 65 erMark MyGetLice
00003DB0: 6E 73 65 4E 61 6D 65 00 5A 65 6F 6E 20 50 44 46 nseName Zeon PDF
00003DC0: 20 44 72 69 76 65 72 00 5A 65 6F 6E 20 50 44 46 Driver Zeon PDF
00003DD0: 20 44 72 69 76 65 72 20 54 72 69 61 6C 00 4D 79 Driver Trial My
00003DE0: 47 65 74 57 4D 53 74 72 69 6E 67 00 4D 79 47 65 GetWMString MyGe
into
00003DA0: 65 72 4D 61 72 6B 00 4D 79 47 65 74 4C 69 63 65 erMark MyGetLice
00003DB0: 6E 73 65 4E 61 6D 65 00 5A 65 6F 6E 20 50 44 46 nseName Zeon PDF
00003DC0: 20 44 72 69 76 65 72 00 00 00 00 00 00 00 00 00 Driver
00003DD0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4D 79 My
00003DE0: 47 65 74 57 4D 53 74 72 69 6E 67 00 4D 79 47 65 GetWMString MyGe
==================================================================================
3TH step
Removing www.zeon.com.tw text (+ background print)
-1-
00002C60: 54 66 0D 0A 00 77 77 77 2E 7A 65 6F 6E 2E 63 6F Tf www.zeon.co
00002C70: 6D 2E 74 77 00 20 00 20 00 20 54 6D 0D 0A 00 31 m.tw Tm 1
00002C80: 20 54 72 20 31 20 4A 20 31 20 6A 20 30 2E 31 20 Tr 1 J 1 j 0.1
into
00002C60: 54 66 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 Tf
00002C70: 00 00 00 00 00 20 00 20 00 20 54 6D 0D 0A 00 31 Tm 1
00002C80: 20 54 72 20 31 20 4A 20 31 20 6A 20 30 2E 31 20 Tr 1 J 1 j 0.1
-2-
00002CA0: 25 73 29 20 54 6A 0D 0A 00 77 77 77 2E 7A 65 6F %s) Tj www.zeo
00002CB0: 6E 2E 63 6F 6D 2E 74 77 00 45 54 0D 0A 00 20 63 n.com.tw ET c
00002CC0: 6D 0D 0A 00 42 49 0D 0A 00 2F 57 20 25 64 0D 0A m BI /W %d
into
00002CA0: 25 73 29 20 54 6A 0D 0A 00 00 00 00 00 00 00 00 %s) Tj
00002CB0: 00 00 00 00 00 00 00 00 00 45 54 0D 0A 00 20 63 ET c
00002CC0: 6D 0D 0A 00 42 49 0D 0A 00 2F 57 20 25 64 0D 0A m BI /W %d
-3-
00002DE0: 00 20 63 6D 0A 00 20 63 6D 0A 00 2F 25 73 20 44 cm
cm
/%s D
00002DF0: 6F 0A 51 0A 00 77 77 77 2E 7A 65 6F 6E 2E 63 6F o
Q
www.zeon.co
00002E00: 6D 2E 74 77 00 57 69 6E 41 6E 73 69 45 6E 63 6F m.tw WinAnsiEnco
into
00002DE0: 00 20 63 6D 0A 00 20 63 6D 0A 00 2F 25 73 20 44 cm
cm
/%s D
00002DF0: 6F 0A 51 0A 00 00 00 00 00 00 00 00 00 00 00 00 o
Q
00002E00: 00 00 00 00 00 57 69 6E 41 6E 73 69 45 6E 63 6F WinAnsiEnco
=============================================================================
4TH STEP disable TIMECHECK-routine
zn32.dll
========
1003CE30: FF 74 1B 83 F8 02 75 12 66 83 7D CE 00 74 0B 83 t Γ░ u fΓ}+ t Γ << edited
-- -- -- -- -- --
1003CE40: 7D DC 00 74 05 6A 01 58 EB 07 33 C0 EB 03 83 C8 }_ t j X┘ 3+┘ Γ+
into
1003CE30: FF 74 1B 83 F8 02 E9 0F 00 00 00 90 00 74 0B 83 t Γ░ ┌ñ ╔ t Γ << original
-- -- -- -- -- --
1003CE40: 7D DC 00 74 05 6A 01 58 EB 07 33 C0 EB 03 83 C8 }_ t j X┘ 3+┘ Γ+
-----------------------------------------------------------------------------------------
File in use 'C:\WINDOWS\SYSTEM\pdfdrv95.drv'. >>> driver called in printers
File in use 'C:\WINDOWS\SYSTEM\ZN32.dll'. >>> main dll
File in use 'C:\WINDOWS\SYSTEM\ZNLIB1.dll'. >>> translator 1
File in use 'C:\WINDOWS\SYSTEM\ZNLIB2.dll'. >>> translator 2
File in use 'C:\WINDOWS\SYSTEM\ZNLIB3.dll'. >>> translator 3
File in use 'C:\WINDOWS\SYSTEM\zlib4.dll'. >>> translator 4