#include "Oraculum.h"

 

DECLARE_CALLBACK_PROTOTYPES(DoPatch_callback, DoActionPatch_callbackStop, DoActionPatch_callbackResume);

 

//Places the original bytes away to let the program continue running.

//Used into the callbacks

BYTE OriginalyBytes[HALT_SIZE];

DWORD dwOriginalyBytesAddr=0;

 

int main(int argc, char** argv)

{

 

       COraculum Oraculum;

 

       if(argc==1) {

             printf("Instruction:\n\n”);

             printf("programName <path_of_WLink.exe>\n\n”);

             printf("The program launches WLink normally.\n”);

             printf("You have to press in WLink the \"Register\" menu and enter any long enough serial.\n”);

             printf("The Oraculum will tell you the real serial.\n”);

             printf("Launch this program from a DOS window to see more infos.\n\n”);

             printf("Tested on version 1.x\n”);

             printf("-----------------------------\n”);

             printf("&8~) Shub-Nigurrath of ARTeam\n");

             return 0;

       }

      

       if(argc!=1)

             Oraculum.SetPath(argv[1]);

 

       //Setup the exe scanning library and control structure

       Oraculum.Setup();

 

       // 004CC3F4 . 59            POP ECX        ;  USER32.77D4919B

       // 004CC3F5 . 56            PUSH ESI       ; /pFileSystemNameSize

       // 004CC3F6 . 56            PUSH ESI       ; |pFileSystemNameBuffer

       // 004CC3F7 . 56            PUSH ESI       ; |pFileSystemFlags

       // 004CC3F8 . 56            PUSH ESI       ; |pMaxFilenameLength

       // 004CC3F9 . 50            PUSH EAX       ; |pVolumeSerialNumber

       // 004CC3FA . 56            PUSH ESI       ; |MaxVolumeNameSize

       // 004CC3FB . 56            PUSH ESI       ; |VolumeNameBuffer

       // 004CC3FC . 68 24CB4F00   PUSH wlApp.004FCB24     ; |RootPathName = "c:\\"

       // 004CC401 . FF15 4C524E00 CALL DWORD PTR DS:[<&KERNEL32.GetVolumeInformationA>];

       //    

       // Final Destination: 004CC442

       // 59565656565056566824CB4F00FF154C524E00

       // Pattern

       // :x59:x56:x56:x56:x56:x50:x56:x56:x68:x24:xCB:x4F:x00:xFF:x15:x4C:x52:x4E:x00

       // Offset: 0x4E

       //

       // From the final destination I would go forward to the next important point:

       // 004CC453  |.  50             PUSH EAX

       // which is at an Offset 0x5F from the initial pattern and an offset of 0x11

       // from the previous patch location! Into this final location I will fish

       // the real serial.

 

 

       Oraculum.AddPattern

(":x59:x56:x56:x56:x56:x50:x56:x56:x68:x24:xCB:x4F:x00:xFF:x15:x4C:x52:x4E:x00", 0x4E);

      

       // Set the final callbacks for the COraculum class.

       Oraculum.SetCallBacks( DoPatch_callback,

                          DoActionPatch_callbackStop,

                          DoActionPatch_callbackResume);

 

       //Add some specific messages to the final output, just to beautify it

       cout << endl

            << "---------------------------------oOOo-----------------------------------------" << endl

            << "This oraculum reports all valid serials for this application" << endl

            << "You can understand which to use reading the serial value. Company's one is the most complete."

            << endl << endl;

 

       // Do the patch at the desired location, and create the suspended process,

       // using CreateProcess API. All these things are managed by COraculum class.

       // The loop code is a little different than usual because we have to fish 4 serial

       // types, to cover all the registration possibility offered by the application.

       // So the whole cycle is repeated:

       // 1. place and EBFE and wait till the program reach the trap

       // 2. store away the seed serial string

       // 3. place another EBFE a little forward to trap the real serial

       // 4. store away the serial number.

       // 5. repeat if idx<5.

       int idx=0;

       if(Oraculum.FindPatterns()>0)

             while(idx<5) {

                    if(Oraculum.DoPatch()>=0)

                          idx++;

             }

      

       //Everything has been done so we can close the victim process

       Oraculum.KillProcess();

                         

       //Return accumulated messages!

       cout << "Messages Stack dump, read information in reverse order.." << endl

            << "--------------------------------------------------------" << endl;

 

       //Flushes the messages stack.

       //Note that because the oraculum uses a messages stack the messages appears

       //in reverse order

       while(!Oraculum.MessageStack().empty()) {

             int idx=Oraculum.MessageStack().size();

             TextString str=Oraculum.MessageStack().top();

             Oraculum.MessageStack().pop();

             printf("%d> %s\n", idx--, str.c_str());

            

       }

 

       cout << "---------------------------------oOOo-----------------------------------------" << endl;

 

       return 0;   

}

 

void DoPatch_callback(COraculum *oraculum, DWORD dwMemoryPatchAddr) {

      

       //Places in a safe place the real bytes of the application..

       //later will be restored to let it continue..

       oraculum->ReadProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)dwMemoryPatchAddr,

             (void*)&OriginalyBytes, HALT_SIZE, NULL);

 

       //Also stores the patch location memory address..

       dwOriginalyBytesAddr=dwMemoryPatchAddr;

      

       oraculum->WriteProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)dwMemoryPatchAddr,

             (void*)&COraculum::HALT_CODE, HALT_SIZE, NULL);     // places the EBFE loop

 

}

 

void DoActionPatch_callbackStop(COraculum *oraculum) {

 

       //If we are here means that the EBFE location specified in the DoPatch_callback

       //has been reached: the program is endless cycling at the same EIP.

 

       //it's time to restore the applications' original bytes.

       oraculum->WriteProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)dwOriginalyBytesAddr,

             (void*)&OriginalyBytes, HALT_SIZE, NULL);    

      

       //EAX contains the pointer to the seed string..

       oraculum->ReadProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)oraculum->GetProcessContext()->Eax,

             oraculum->GetProcessBuffer(), 100, NULL);

 

       //pushes the string in the messages stack for later retrieval..

       char str[256];

       sprintf(str, "The correct serials for licence: %s is:",

               oraculum->GetProcessBuffer());

 

       oraculum->pushMessage(str);

 

       //////////////////////////////////////////////////////////////////////////

       //Prepare things for the second stop a little forward, where to get the real

       //serial..

       //COraculum class is not able to stop on its stops (it’s not recursive) so we

       //must code on our own the essential things:

       //place an EBFE, loop till it’s reached, restore the original code and read EAX..

      

       //The new location where to stop is 0x11 bytes forward the actual location where

       //we stopped..

       dwOriginalyBytesAddr=dwOriginalyBytesAddr +0x11;

 

       //Places in a safe place the real bytes of the application..later will be restored.

       oraculum->ReadProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)dwOriginalyBytesAddr,  //the second stop is 0x11 bytes forward

             (void*)&OriginalyBytes, HALT_SIZE, NULL);

 

       //writes the EBFE bytes to stop at the right location

       oraculum->WriteProcessMemory(oraculum->GetPI()->hProcess,

             (LPVOID)dwOriginalyBytesAddr,

             (void*)&COraculum::HALT_CODE, HALT_SIZE, NULL);   // places the EBFE loop

 

       //resume the thread from it's suspended mode to be able to get to the new EBFE loop

       //(that is continue the execution)

       ResumeThread(oraculum->GetPI()->hThread);

 

       //Check continuously while we reach the point

       while(GetThreadContext(oraculum->GetPI()->hThread, oraculum->GetProcessContext()))

       {

             //If EIP is equal to the address where we placed the EBFE loop we reached

             //the right point thus we can collect the remaining information

             if(oraculum->GetProcessContext()->Eip==dwOriginalyBytesAddr) {

                   

                    //suspend again the thread to let our oraculum take required data.

                    SuspendThread(oraculum->GetPI()->hThread);

                   

                    //Eax contains the pointer to real serial code string..

                    oraculum->ReadProcessMemory(oraculum->GetPI()->hProcess,

                          (LPVOID)oraculum->GetProcessContext()->Eax,

                          oraculum->GetProcessBuffer(), 100, NULL);    

 

                    //The buffer used by COraculum class is unique thus with this call

                    //we have just overwritten it. It was still containing the the serial

                    //seed string.

                    //For this cycle we do not anymore need to modify this buffer so we

                    //can leave the push of its

                    //value into the messages stack to the DoActionPatch_callbackResume

                    //callback.

 

                    //restore the application's original bytes so as to let it continue

                    //once resumed

                    oraculum->WriteProcessMemory(oraculum->GetPI()->hProcess,

                          (LPVOID)dwOriginalyBytesAddr,

                          (void*)&OriginalyBytes, HALT_SIZE, NULL); // removes EBFE loop

 

                    //stop the while loop

                    break;

 

             }

             Sleep(10);

       }

 

       //Once returned from this callback the oraculum framework will resume the

       //thread and will continue to the next stop set in the DoPatch_callback callback.

}

 

void DoActionPatch_callbackResume(COraculum *oraculum) {

 

       //writes the collected code into the messages stack

       char str[256];

       sprintf(str,"%s", oraculum->GetProcessBuffer());

       oraculum->pushMessage(str);

}