# Target: Costy's Second Crackme - Crack this Bitmap Creator
# By: Costy
# Date: 30. Apr, 2008
# Broken: 15. May, 2008
# By: JiM~
#
# Tools:
# - VBReFormer v3.7
# - WinHex 12.5
The goal for this crackme is to remove the 'DEMO' watermark from this simple
image creation software.
To start things off, let's run the application and see what we're up against.
Draw something and save it. It gets a nice Microsoft WordArt style 3D wiggly
'DEMO' watermark pasted on the top left corner. Ugly! I want to see the
smiley face I drew! :P
There's a bunch of ways to go about removing the watermark. First, is to simply
eliminate the image resource and replace it with null data. Other ways include
removing the code section where the watermark is set visible and pasted onto
the image, moving the image to a different coordinate off the image, and some
other hardcore RCE fun with a debugger.
Let's try the easier fix and simply nullify the watermark.
#
# METHOD : Nulling the Image
#
Open up crackme2.exe in VBReFormer and take a look at the first resource under
the Form1.frx tree. There's our watermark image. It's a 24.31KB bitmap image.
Neato. Export the image resource with VBReFormer and save it as something like
watermark.bmp
Now, open up your favorite hex editor and open both crackme2.exe and our
watermark.bmp. Let's copy the first five bytes of watermark (0x424D3E610000)
and search crackme2.exe for it. It should only have one result, since it's
unlikely that there will be another bitmap header embedded in there. If there
was, we'd just have to increase the size of our search term. Anyway, we find
that our watermark is stored in crackme2.exe at offset 0x1382.
Let's get dirty and replace that bitmap with a null bitmap. A quick google
search for "bmp file format" turns up some nice results on how a bitmap file
is composed. At offset 0x13, the width of the image is stored, and at offset
0x17, the height. Both the width and the height are 4 bytes long. Let's set
those values to 0 :)
Taking a quick look at watermark.bmp again checking at offsets 0-13 and 0x17,
we find 0x78 and 0x45 stored as the width and height of the image.
Moving over to crackme2.exe, we see the corresponding offsets 0x1394 and
0x1398. Replace both bytes with 0x00. This will change the width and height
attributes of the bitmap to 0, making a null image with no width or height. When
the application goes to paste the watermark, it will still recognize the bitmap
as being a valid bitmap, but when it goes to paste it, it'll be pasting nothing.
Save your changes as crackme2_nulled.exe and try it out. Works fine :)