
                               
                 
                                     
                                            
                                                 
                                                
               _                                
                            ߰             
                                           
                      ߰                
                                      ߰  
     ߰             ߰                   
                                              
                                              
                                         
                             
                        
     ߰                      
                                                                                
                                  ܱܰ                                  
                             ߰            ߰               
                                                                    
          ߰                                                             
                         E A T i S O  P R E S E N T S                         
                                                                              
                                                                                
                         .Alien.Skin.Splat.v1.0-EATiSO.                         
                                                                                
                                                                                
                                                                                
                                                                              
                                                                    
    ۱۲                                            ۲۲    
   ۲߲߰             RELEASE  INFO              ߲߰۲۲   
  ۲          ۲                                  ܲ          ߲  
                     ۲                  ޲                     
                 ߲                          ۲               ۲  
   ߲               ۱                ܱ               ܲ   
                 ߲                  ߲                 
߲                                                          ۲ݲ
޲                                                              ݱ
޲                                                                    ۲ݱ
                                                                      ݱ
                                                                      ݰ
      SUPPLIER ....: TEAM EAT                                           ۰
      PROG TYPE ...: GFX PLUGGIE                                        
       LANGUAGE ....: ENGLISH                                             
        RELEASE DATE.: 04/28/02                                             
                                                                            
        CRACKER .....: TEAM EAT                                             
         PROTECTION ..: SERIAL                                                
         DIFFICULTY ..: SUPER FUN                                             
                                                                              
         PACKAGER ....: TEAM EAT                                              
         FORMAT ......: BIN/CUE                                               
         COMPRESSION .: m5e                                                   
         ARCHIVE NAME.: eatassp1.rar                                          
         No OF DISKS .: [15MB/17]                                             
                                                                              
         REQUIREMENTS : WIN98/ME/NT/2K/XP                                     
         RETAIL DATE..: MARCH 2002                                            
         PRICE .......: $99.00                                                
         WEBSITE......: http://www.alienskin.com/splat/splat_main.html        
                                                                              
                                                                            
                                                                          
ܰ                                                           ۱
  ۲۲                                                     ܲ۲ 
      ߲                                        ۲     
          ߲                             
     ܲ  ۲ ۲ܲ ߲       
   ߰          ߲۲ ۱޲۱                 
                 ۲  ߰޲߲ݰ              ޲۲ݰ        ܲ           
                       ߲ܰ                      ۲       ߰               
                          ۲                                              
                       ۲                      ߲                       
                                                  ߲                    
                                                                              
                                                                                
                                                                                
                                                                              
                                                                    
    ۱۲                                            ۲۲    
   ۲߲߰             RELEASE  NOTES             ߲߰۲۲   
  ۲          ۲                                  ܲ          ߲  
                     ۲                  ޲                     
                 ߲                          ۲               ۲  
   ߲               ۱                ܱ               ܲ   
                 ߲                  ߲                 
߲                                                          ۲ݲ
޲                                                              ݰ
޲                                                                    ۲ݰ
                                                                      ݰ
                                                                      ݰ
                                                                          ۰
                                                                        
                                                                          
                                                                            
             Splat! is a powerful, new filter set for Adobe                   
             Photoshop and other graphics programs. Easy to use               
             and versatile, Splat! combines frames, textures,                 
             edges, borders, mosaics and more with the                        
             award-winning interface of Eye Candy 4000 in an                  
             all-new, affordable plug-in. Digital photographers,              
             graphic designers, Web monkeys and digital artists               
             can set their images apart using the stunning                    
             effects of Splat!                                                
                                                                            
                                                                            
                                                                          
ܰ                                                           ۱
  ۲۲                                                     ܲ۲ 
      ߲                                        ۲     
          ߲                             
     ܲ  ۲ ۲ܲ ߲       
   ߰          ߲۲ ۱޲۱                 
                 ۲  ߰޲߲ݰ              ޲۲ݰ        ܲ           
                       ߲ܰ       COMMENTS       ۲       ߰               
                          ۲                                              
                       ۲                      ߲                       
                                                  ߲                    
                                                                            
                                                                              
                     Check out the end of this nfo file                         
                    for the crack story :)                                    
                                                                                
              Ollydbg Tip Of The Day #3: Debugging Installers with              
              dynamic loaded dlls                                               
              Lots of installers now a days hide serial check dlls              
              inside the setup.exe, and unpack only when the                    
              program runs, into a system temp file.  And worse                 
              they dynamically load and unload them just whenthe                
              serial is checked. can be tricky.  Here's a tip for               
              you.  Load your setup.exe into olly. Go                           
              Options->Debugging OPtions.  UNCHECK "break on new                
              dll" then run your setp right up to the point where               
              you are about to click "OK to check your serial.                  
              Then go back to olly, and open options, and CHECK                 
              the break on new dll.  Then when you click OK it                  
              will break when the dynamic serial check DLL is                   
              loaded.  Do View->Executable Modules to find it.                  
              That trick was used here and it will serve you well               
              with Wise and Installshield alike.                                
                                                                          
                                                                  
                  ۲۰                          ܰ۲                  
                      ۲۰                    ܰ۲                      
                          ۲                  ޲                          
                       ۲                    ۲                       
                    ܲ                            ۲                    
                                                                            
                                                                                
                                                                                
                                                                                
                                                                                
                                                                              
                                                                    
    ۱۲                                            ۲۲    
   ۲߲߰           INSTALLATION NOTES           ߲߰۲۲   
  ۲          ۲                                  ܲ          ߲  
                     ۲                  ޲                     
                 ߲                          ۲               ۲  
  ߲               ۱                ܱ               ܲ  
                 ߲                  ߲                 
߲                                                          ۲ݲ
޲                                                              ݱ
޲                               `TLB'                                ۲ݱ
                       Try it, Like it, Buy it.                       ݱ
                                                                      ݰ
                                                                          ۰
                                                                        
                                                                          
                                                                          
             Install, when prompted for                                       
             Name, Company: Anything you like                                 
             Serail: CHDDEFGHGCFE                                             
                                                                              
                                                                              
                                                                            
                                                                          
ܰ                                                           ۱
  ۲۲                                                     ܲ۲ 
      ߲                                        ۲     
          ߲                             
     ܲ  ۲ ۲ܲ ߲       
   ߰          ߲۲ ۱޲۱                 
                 ۲  ߰޲߲ݰ              ޲۲ݰ        ܲ           
                       ߲ܰ                      ۲       ߰               
                          ۲                                              
                       ۲                      ߲                       
                                                  ߲                    
                                                                            
                                                                            
   ܲ                                                                    ߲   
                                                                          
                                                                      ۲  
 ߲                                                              ܲ 
                      ޲   EAT  CONTACT                         
߲                                                          ܲݲ
޲                                                            ݱ
޲                                                                    ۲ݱ
                                                                      ݱ
                                                                      ݱ
                                                                          
                                                                      
     Like to share with TEAM EAT? We are looking for:                 
     Experienced Programmers, Crackers, & Graphic Artists.           
     Suppliers of Quality Software                                   
      (retail date Not older than 6 months!).                         ݰ
     We are *NOT* looking for:                                       ۰
       couriers, carders, shells, sites, or hardware.                   
                                                                          
       CONTACT .........: teameat@gmx.net                                 
                                                                            
                                                                          
                                                                            
                  ANY AND ALL REQUESTS FOR FILES,CRACKS,SERIALS,              
                          AND THE SUCH WILL BE IGNORED.                       
                                                                              
                                                                              
                                                                            
                                                                          
ܰ                                                           ۱
  ۲۲                                                     ܲ۲ 
      ߲                                        ۲     
          ߲                             
     ܲ  ۲ ۲ܲ ߲       
   ߰          ߲۲ ۱޲۱                 
                 ۲  ߰޲߲ݰ              ޲۲ݰ        ܲ           
                       ߲ܰ                      ۲       ߰               
                          ۲                                              
                       ۲                      ߲                       
                                                  ߲                    
                                                                                
                                                                              
                                                                    
    ۱۲                                            ۲۲    
   ۲߲߰               EAT  NEWS                ߲߰۲۲   
  ۲          ۲                                  ܲ          ߲  
                     ۲                  ޲                     
                 ߲                          ۲               ۲  
  ߲               ۱                ܱ               ܲ  
                 ߲                  ߲                 
߲                                                          ۲ݲ
޲                                                              ݱ
޲                                                                    ۲ݱ
                                                                      ݱ
                                                                      ݰ
                                                                          ۰
                                                                        
                                                                          
                                                                          
                                                                              
                           ::::::::::::::::::::::::::                         
                                                                              
                                                                              
                                                                              
                                                                            
                                                                          
ܰ                                                           ۱
  ۲۲                                                     ܲ۲ 
      ߲                                        ۲     
          ߲                             
     ܲ  ۲ ۲ܲ ߲       
   ߰          ߲۲ ۱޲۱                 
                 ۲   ޲߲ݰ              ޲۲         ܲ           
                                                            ߰               
                                                                                
                                                                              
                                                                    
    ۱۲                                            ۲۲    
   ۲߲߰               GREETINGS                ߲߰۲۲   
  ۲          ۲                                  ܲ          ߲  
                     ۲                  ޲                     
                 ߲                          ۲               ۲  
  ߲               ۱                ܱ               ܲ  
                 ߲                  ߲                 
߲                                                          ۲ݲ
޲                                                              ݱ
޲                                                                    ۲ݱ
                                                                      ݱ
                                                                      ݰ
                                                                          ۰
                                                                        
                                                                          
                                                                          
                            :o) clady & HavinFun (o:                          
                                     tGF                                      
                                                                              
                                                                              
                                                                            
                              ۲ܲ                               
                         ۲                          
                       ۲۰۲                        ۰
                    ۱۲۲                     ۰
                   ۲۲۲                    ݰ
                  ۲۰۲                   
                 ۲۱۲                  
               ۲۲۲                 
   ߱         ۲۱۲                
              ۲۱۲              ݰ
               ۲۰۲      ߱       
              ۲۰۲۲               ݰ
޲              ۲۰۲۲               ۲ݰ
޲           ۲۲۲۲            ݰ
             ۲۲              
 ܱ           ۲ݰ۲             ܱ 
    ߱    ۲۰۲           
 ܲ         ۲۲    ߱   ߱ 
    ܲ      ۲۲       ۲    
  ޲       ۲۲        ۲  
           ۲۲۲۲۲          ۰  
      ۲۲۲۲        
     ۲۲۲۲۲       
      ݲ۲۲۲۲۲۲۲       
        ۲۲۲         
        ۲۲۲    ۲     
    ۲        ۲۲۲             
               ۱۲۲                
             ۲۲               
      ߱     ۱۲               
                ۱۲                 
                 ۱۱                  
                ۱۱    n0!          
                                    
                   ۲޲            ߱     
                                 ݰ            
                                                          
           ۰ ߱                                                       
                   NFO LAST UPDATE ON 12/09/2001                    
                                                                        
                                                                           
                                               ߱                        
                                                                            
                                                                              
                                                                         
     
                                                                                
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

CRACK STORY:
//---------------------------------------------------------------------------
[wooster] .
[wooster] itchy you there
[wooster] solved it
[wooster] you want a serial?
[wooster] CHDDEFGHGCFE
[itchy] u joke :o)))
[wooster] ser that with
[itchy] WOW
[wooster] name and company:
[itchy] cool work
[wooster] was SUPER FUN
[wooster] very rare that once can do a BRUTE FORCE INLINE PATCH
[wooster] but
[wooster] i am not going to write a generic keygen
[wooster] its too big a pain
[wooster] basically what i did was
[wooster] i wrote extra code into the program
[wooster] to internally search for a valid serial number for me
[wooster] but anyway
[wooster] ive dont that before and got fluxored
[wooster] because it would have taken 24 million years to find a good serial
[itchy] :o)
[wooster] but alienskin not so smart
[itchy] k
[wooster] took about .5 seconds
[wooster] lol
[itchy] amazing ;o))
[wooster] alien skin needs to do a bit more work
[itchy] must be nice to just get a home run like that
[wooster] the only other thing was to figure out the last 4 digits
[wooster] which were a kind of checksum
[wooster] ther serial procedure looks like this
[wooster] :
[wooster] first, the setup program looks up the ProgramID of the alienskin app
[wooster] in this case its "616" which maps to 268 hex
[wooster] then it takes your serial
[wooster] and breaks it into 3 four-character sections
[wooster] checks to make sure they are all letters
[wooster] then converts each section from letters to digits, with A->0 B->1
[wooster] then it does a checksum check
[wooster] on first two groups
[wooster] when they are xored together
[wooster] they must = third group
[wooster] this is typical crc check

	00EC1380  68 3091EC00       PUSH INST011.00EC9130                                     ; ASCII "%x"
	00EC1385  8D55 F0           LEA EDX,DWORD PTR SS:[EBP-10]
	00EC1388  52                PUSH EDX
	00EC1389  E8 16040000       CALL INST011.00EC17A4
	00EC138E  83C4 0C           ADD ESP,0C
	00EC1391  8D45 E4           LEA EAX,DWORD PTR SS:[EBP-1C]
	00EC1394  50                PUSH EAX
	00EC1395  68 3091EC00       PUSH INST011.00EC9130                                     ; ASCII "%x"
	00EC139A  8D4D C0           LEA ECX,DWORD PTR SS:[EBP-40]
	00EC139D  51                PUSH ECX
	00EC139E  E8 01040000       CALL INST011.00EC17A4
	00EC13A3  83C4 0C           ADD ESP,0C
	00EC13A6  8D55 F8           LEA EDX,DWORD PTR SS:[EBP-8]
	00EC13A9  52                PUSH EDX
	00EC13AA  68 3091EC00       PUSH INST011.00EC9130                                     ; ASCII "%x"
	00EC13AF  8D45 E8           LEA EAX,DWORD PTR SS:[EBP-18]
	00EC13B2  50                PUSH EAX
	00EC13B3  E8 EC030000       CALL INST011.00EC17A4
	00EC13B8  83C4 0C           ADD ESP,0C
	00EC13BB  8B4D B0           MOV ECX,DWORD PTR SS:[EBP-50]
	00EC13BE  334D E4           XOR ECX,DWORD PTR SS:[EBP-1C]				// first set
	00EC13C1  894D B4           MOV DWORD PTR SS:[EBP-4C],ECX
	00EC13C4  8B55 F8           MOV EDX,DWORD PTR SS:[EBP-8]				// second set
	00EC13C7  3B55 B4           CMP EDX,DWORD PTR SS:[EBP-4C]                             ; crc check, compare xor of 1 and 2 with 3

[wooster] then it does some involved processing comobining mathematically the first two grops
[itchy] k
[wooster] and when done the maths must = the product id = 268= "616"
[wooster] so i just patched code
[wooster] to try to modify the first group
[wooster] and cycle until it hits a match

	00EC13D0  66:8B45 B0        MOV AX,WORD PTR SS:[EBP-50]			// from here to end is final serial check
	00EC13D4  66:8945 C8        MOV WORD PTR SS:[EBP-38],AX			// 1st set of 4 digits
	00EC13D8  66:8B4D E4        MOV CX,WORD PTR SS:[EBP-1C]
	00EC13DC  66:894D CA        MOV WORD PTR SS:[EBP-36],CX			// 2nd set of 4 digits
	00EC13E0  66:C745 DC 91A2   MOV WORD PTR SS:[EBP-24],0A291		// constants
	00EC13E6  66:C745 DE FABB   MOV WORD PTR SS:[EBP-22],0BBFA
	00EC13EC  66:C745 E0 1AB2   MOV WORD PTR SS:[EBP-20],0B21A
	00EC13F2  66:C745 E2 445F   MOV WORD PTR SS:[EBP-1E],5F44
	00EC13F8  8D55 DC           LEA EDX,DWORD PTR SS:[EBP-24]
	00EC13FB  52                PUSH EDX
	00EC13FC  8D45 C8           LEA EAX,DWORD PTR SS:[EBP-38]
	00EC13FF  50                PUSH EAX
	00EC1400  8B4D AC           MOV ECX,DWORD PTR SS:[EBP-54]
	00EC1403  E8 08FDFFFF       CALL INST011.00EC1110				// ?
	00EC1408  0FB74D C8         MOVZX ECX,WORD PTR SS:[EBP-38]			// replace crypted 1st set
	00EC140C  0FB755 CA         MOVZX EDX,WORD PTR SS:[EBP-36]			// replace crypted 2nd set
	00EC1410  C1E2 10           SHL EDX,10							// now down here we just manipulate these two
	00EC1413  0BCA              OR ECX,EDX
	00EC1415  894D FC           MOV DWORD PTR SS:[EBP-4],ECX
	00EC1418  8B45 FC           MOV EAX,DWORD PTR SS:[EBP-4]
	00EC141B  25 FFFF0F00       AND EAX,0FFFFF
	00EC1420  8945 BC           MOV DWORD PTR SS:[EBP-44],EAX
	00EC1423  8B4D FC           MOV ECX,DWORD PTR SS:[EBP-4]
	00EC1426  81E1 0000F0FF     AND ECX,FFF00000
	00EC142C  C1E9 14           SHR ECX,14
	00EC142F  66:894D B8        MOV WORD PTR SS:[EBP-48],CX					// store manipulated computation above
	00EC1433  0FB755 0C         MOVZX EDX,WORD PTR SS:[EBP+C]			// where is this computed??? - this is 268 = "616", the program version
	00EC1437  0FB745 B8         MOVZX EAX,WORD PTR SS:[EBP-48]			// maniuplated computation above
	00EC143B  3BD0              CMP EDX,EAX						// 268 vs A82  (the A82 is the computer code based on our serial)  268 = "616" = product code, computeed earlier
	00EC143D  74 04             JE SHORT INST011.00EC1443			// jump on final good
	00EC143F  33C0              XOR EAX,EAX
	00EC1441  EB 03             JMP SHORT INST011.00EC1446
	00EC1443  8B45 BC           MOV EAX,DWORD PTR SS:[EBP-44]
	00EC1446  8BE5              MOV ESP,EBP
	00EC1448  5D                POP EBP
	00EC1449  C2 0800           RETN 8

INLINE BRUTE FORCE LOOP PATCH (done with olly of course):

	00C9143D  74 0C             JE SHORT INST011.00C9144B
	00C9143F  66:8B45 B0        MOV AX,WORD PTR SS:[EBP-50]
	00C91443  66:40             INC AX
	00C91445  66:8945 B0        MOV WORD PTR SS:[EBP-50],AX
	00C91449  EB 89             JMP SHORT INST011.00C913D4
	00C8144B  66:8B45 B0        MOV AX,WORD PTR SS:[EBP-50] 		BP HERE and check out AX

[wooster] then after match
[wooster] i manually set the crc of 3rd group correctly
[wooster] voila
[itchy] jeez
[wooster] thats why my second group is fixed "EFGH"
[wooster] because you set that to whatever
[wooster] and then force a search over group1
[wooster] now generally this is an okay strategy for a keygen
[wooster] its not that unusually
[wooster] BUT
[wooster] usually youve got to search 12 digit codes
[wooster] and only 1 is valid
[wooster] in this case
[wooster] search was only over 4 digits
[wooster] and there are MANY valid combos
[wooster] so it is easy
[wooster] .
[wooster] anyway
[wooster] sorry to bore you
[wooster] but its just fun to be able to do an inline brute force crack
[itchy] not at all - i may make meaning of all that one day :o)
[itchy] i'm sure u were bamboozzled by that stuff when u first started
...
[itchy] u won't believe it - i just got a real serial :o))
[itchy] he he
[wooster] LOL
[wooster] oy what a waste of time
//---------------------------------------------------------------------------
                                                                             
