Incredibly short *Cracking TwinR Thread*

[skyboi91]

Cracking TwinR Thread

TwinR Offical forum (Get TwinR here)




Greeting all cabalers,

TwinR is a impressive cabal bot program for SEA and NA, packed with themida V1.945, need a lic.file to activate the bot. Let's tackle it !

Let's get started now,

Download below tutorial by LCF-AT cracking TwinR video 2.40 mb
Thanks LCF-AT for all his efforts, I really appreciate his works.

also download the twinr2.lic file without this you can't do it.

Stuffs needed

9 in 1 OLLYDBG for themida 1.9x


Get a phantom and ollyscript plugins below (ollyscript plugin is for running scripts).



Just follow the guide by LCF-AT as close as possible.....his tutorial is long just bear with it....

The advanced loader generator is another alternative way, after running the winlicense unpacker 1.0 script

HWID/Check= ok
Temp patch=no

Then it a new script will be produced in the same folder of the TwinR the script will look like this

Advanced Loader Generator Patches for TwinrSEA2.0.25

NOTE: JUMP PATCH ADDRESS is INSIDE from our TARGET!YOU CAN CREATE A LOADER WITH THIS SCRIPT!

Address First Original

VA:
009B3702

Bytes:
E90263FFFF

Address First Patched

VA:
009B3702

Bytes:
E931831500

Address Second Original

VA:
00B0BA38

Bytes:
#00# x 00000025 HEX Value

Address Second Patched

VA:
00B0BA38

Bytes:
#81FAEF289A00741581FA3B189A007405E9BCDFE9FFC702000 50000EBF3C70202000000EBEB#

*************************
gRn @ LCF-AT

Then just run the advanced loader generator

Browse TwinR.exe
Priority=> themida 1.3+
Highest

Then just add those patched bytes and the virtual address according ... and generate a loader and execute the loader remember you must have a twin.lic file for this.

LordPE Download

[iNFIDEL_]

Leave this thread and don't ask if you don't know how.
>_>

edit: request to pin/sticky this for easy access. ty.

[-Chrome-]

#sticky

[hackerakohehe]

can this be use in cabal ph?

[blackmorpheus]

this is for cabal eu?
nice tut

[lunapt]

Nice, now try and crack NA Cabalrider... please? xD ^_^

[RICANPAPI_16]

does it work with twinrNA?

[Deftron]

Quite troublesome... i only can do halfway and stuck there lol..
maybe if you could crack it for us, then i would be much easier.

or u could make it incredibly long and complete tutorial, with creenshot of course ^^

good job on tutorial, now i can understand something that i dont before ^^

[skyboi91]

hi i would make a better tut .... creating a loader for twinr

[skyboi91]

next tut only run a script and creating loader by LCF-AT ...

////////////////////////Ch鈚eau-Saint-Martin///////////////////////////////////////////////
// //////////////////
// FileName : WinLicense HWID & TRIAL Loader & Bypass Creater {U1} /////////////////
// Features : ////////////////
// Use this script to create a loader which can ///////////////
// bypass the HWID & TRIAL check in the packed //////////////
// WinLicense file. /////////////
// ////////////
// 1. Script inline磗 the HWID & TRIAL patch ///////////
// 2. Create磗 a extra file with all patches //////////
// for Advanced Loader Generator etc. /////////
// 3. Patch Method CISC & RISC (memory) ////////
// ///////
// //////
// Environment : WinXP,OllyDbg V1.10,OllyScript v1.65.4 /////
// Author : LCF-AT ////
// Date : 2009-07-03 ///
// //
// //
///////////////WILLST DU SPAREN,DANN MU逿 DU SPAREN!////////////////////

var GetLocalTime
var VirtualAlloc
var apibase
var apibase2
var LoadLibraryA
var rappa
var SECTEST
var HWID
var CALC
var ADDRESS
var TRIAL
var JUMP
var NEWPATCH
var JUMP_2
var BINARY
var BINARYJUMP
var FIRSTJUMP
var NULLER
var TESTER
var risc
var TALLA
var JUMP_B
var DEST
var A
var B
var C
var JUMP_start
var NAME
var M_BASE
var M_SIZE
var MEM_TEST
var MEMO
var EXTRAADDRESS
var FRG
/////////////////////////////
lc
dbh
BC
bpmc
bphwcall
dbh
GPI PROCESSNAME
mov NAME, $RESULT
gpi MAINBASE
mov M_BASE, $RESULT
gmi M_BASE, MODULESIZE
mov M_SIZE, $RESULT
add M_SIZE, M_BASE
mov M_SIZE, M_SIZE

start0:
mov $RESULT, 0
ask "Enter a address of free space if you alraedy have!If not then enter nothing and press a button"
cmp $RESULT, 0
je HAL_2
cmp $RESULT, FFFFFFFF
je ende_2
cmp $RESULT, 02
je ende_3

mov A, $RESULT
mov B, $RESULT
mov C, $RESULT
READSTR C, len
mov C, $RESULT
len $RESULT
mov C, $RESULT
cmp $RESULT, 0
ja ende_2
mov FRG, A
and FRG, ffff0000
mov FRG, FRG
cmp FRG, 0
je ende_2
mov FRG, A

////////////////////////////////////
HAL:
inc EXTRAADDRESS
////////////////////////////////////
HAL_2:
bpmc

gpa "GetLocalTime", "kernel32.dll"
mov GetLocalTime, $RESULT

find GetLocalTime, #C9C20400#
cmp $RESULT, 0
jne hessel
pause

hessel:
mov GetLocalTime, $RESULT+1
bphws GetLocalTime ,"x"
esto
bphwc GetLocalTime
sti
gpa "VirtualAlloc", "kernel32.dll"
mov VirtualAlloc, $RESULT

find VirtualAlloc, #C21000#
cmp $RESULT, 0
jne seiber
pause
seiber:
mov VirtualAlloc, $RESULT
bphws VirtualAlloc ,"x"
esto
bphwc VirtualAlloc
sti
mov apibase,eax
log apibase

gpa "LoadLibraryA", "kernel32.dll"
mov LoadLibraryA, $RESULT

find LoadLibraryA, #C20400#
cmp $RESULT, 0
jne wessel
pause

wessel:
mov LoadLibraryA, $RESULT
bphws LoadLibraryA ,"x"
esto
bphwc LoadLibraryA
sti

API_1:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE81B0000005DC21 000#
cmp $RESULT, 0
jne API_start

API_2:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE884FFFFFF5DC21 000#
cmp $RESULT, 0
jne API_start

API_3:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE878FFFFFF5DC21 000#
cmp $RESULT, 0
jne API_start

API_4:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8090000005DC21 000#
cmp $RESULT, 0
jne API_start

API_5:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8040000005DC21 000#
cmp $RESULT, 0
jne API_start

API_6:
find apibase, #558BECFF7514FF7510FF750CFF75086AFFE8????????5DC21 000#
cmp $RESULT, 0
je ende

mov apibase, $RESULT
inc rappa
inc apibase
cmp rappa, 2
je API_starta
jmp API_6

API_starta:
dec apibase
//////////////////////////
API_start:
mov apibase2, $RESULT
bphws apibase2 ,"x"

RAS:
esto
mov SECTEST, [esp]
cmp SECTEST, 0
je RAS

gmemi SECTEST, MEMORYBASE
mov SECTEST, $RESULT

find SECTEST, #B8010000008985????????C785????????01000000#
cmp $RESULT, 0
je RAS

mov HWID, $RESULT
add HWID, 0B

add HWID, 02
mov HWID, [HWID]
add HWID, ebp
mov HWID, HWID
mov CALC, ebp

log HWID
log [HWID]
//////////////////mov [HWID], 02
log ebp

bphws HWID, "w"
bphwc apibase2

RAS_2:
esto

mov [HWID], 02
mov TALLA, eip+06
cmp [TALLA], 0FFFFFFFF
je RAS_2

gmemi eip, MEMORYBASE
mov MEM_TEST, $RESULT

cmp M_BASE, MEM_TEST
ja TR1

cmp M_SIZE, MEM_TEST
jb TR1
jmp TR2

TR1:
eval "JUMP PATCH ADDRESS is OUTSIDE from our TARGET!YOU CAN碩 CREATE A LOADER WITH THIS SCRIPT!"
log $RESULT, ""
mov MEMO, $RESULT
jmp TR3

TR2:
eval "JUMP PATCH ADDRESS is INSIDE from our TARGET!YOU CAN CREATE A LOADER WITH THIS SCRIPT!"
log $RESULT, ""
mov MEMO, $RESULT

TR3:
mov [HWID], 02

mov risc, [eip]
and risc, 0ffff
mov risc, risc
cmp risc, A4F3 // RISC F3A4
je RISC
///////////////////////////jmp RAS_3A
mov TALLA, [eip]
and TALLA, 0ff
mov TALLA, TALLA
cmp TALLA, E9
je RAS_3
pause
pause

RAS_3:
esto
RAS_3A:
mov [HWID], 02
mov ADDRESS, eip
find SECTEST, #81BD????????00050000#
cmp $RESULT, 0
je RAS_3

mov ADDRESS, eip
mov TRIAL, $RESULT
log TRIAL

opcode ADDRESS
/////////////////////////READSTR [ADDRESS], 5
mov FIRSTJUMP, $RESULT

add TRIAL, 02
mov TRIAL, [TRIAL]
add TRIAL, CALC
mov TRIAL, TRIAL
log TRIAL
log [TRIAL]
mov [TRIAL], 500
///////////////////////////
PATCHERS:
bphwcall

gci ADDRESS, DESTINATION
cmp $RESULT, 0
jne RAS_4
pause
pause

RAS_4:
mov JUMP, $RESULT
mov NULLER, #00#

mov NEWPATCH, FRG
mov JUMP_2, FRG
cmp EXTRAADDRESS, 0
jne RAS_5S1

find eip, #0000000000000000000000000000000000000000000000000 000000000000000000000000000000000#
cmp $RESULT, 0
jne RAS_5
pause
pause

RAS_5:
mov NEWPATCH, $RESULT
mov JUMP_2, $RESULT
RAS_5S1:
mov [NEWPATCH], #81FAEEEEEEEE741581FAEEEEEEEE7405E9A7B73EEEC702000 50000EBF3C70202000000EBEB#
add NEWPATCH, 02
mov [NEWPATCH], HWID
add NEWPATCH, 08
mov [NEWPATCH], TRIAL
add NEWPATCH, 06
eval "JMP {JUMP}"
asm NEWPATCH, $RESULT

eval "JMP {JUMP_2}"
asm ADDRESS, $RESULT

eval "This are the bytes which you have to enter in Advanced Loader Generator!"
log $RESULT, ""
log "-----"

opcode ADDRESS
mov BINARYJUMP, $RESULT

find JUMP_2, #00000000#
cmp $RESULT, 0
jne RAS_6
pause
pause

RAS_6:
mov TESTER, $RESULT
sub TESTER, JUMP_2
mov TESTER, TESTER

READSTR [JUMP_2], TESTER
mov BINARY, $RESULT


eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP} \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"
log "Advanced Loader Generator DATA!"
MSG $RESULT
log ADDRESS
log FIRSTJUMP, ""
log ADDRESS
log BINARYJUMP, ""
log JUMP_2
log NULLER, ""
log JUMP_2
log BINARY, ""
jmp FILE

ende:
msg "Can磘 find the API Base!Maybe your target still needs some dll file?"
pause
ret

FILE:
eval "ALG Patches for {NAME}.txt"
mov sFile, $RESULT
eval "Advanced Loader Generator Patches for {NAME}"
wrt sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
eval "NOTE: {MEMO}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address First Original"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{ADDRESS}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{FIRSTJUMP}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address First Patched"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{ADDRESS}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{BINARYJUMP}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address Second Original"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{JUMP_2}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{NULLER} x {TESTER} HEX Value"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Address Second Patched"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "VA: "
eval "{JUMP_2}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "Bytes: "
eval "{BINARY}"
wrta sFile, $RESULT
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "*************************"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
wrta sFile, "gRn @ LCF-AT"
wrta sFile, "\r\n"
wrta sFile, "\r\n"
eval "Script finished!All patches are written into a new file now! \r\n\r\nPress run to start your app now if you like!"
msg $RESULT
pause
ret
/////////////////////////////////////////
/////////////////////////////////////////
RISC:
mov A, edi
sub A, 01
mov A, A

mov B, [A]
///////////////// cmp B, 02 // HWID
//////////////// jne RISC_3
mov HWID, A
mov HWVALUE, B
mov [HWID], 02

mov JUMP_start, eip
findop JUMP_start, #E9#
cmp $RESULT, 0
jne RISC_2
pause
pause

RISC_2:
mov JUMP_B, $RESULT
gci JUMP_B, DESTINATION
mov DEST, $RESULT

RISC_2A:
esto
mov [HWID], 02
find SECTEST, #81BD????????00050000#
cmp $RESULT, 0
je RISC_2A

mov TRIAL, $RESULT
log TRIAL
add TRIAL, 02
mov TRIAL, [TRIAL]
mov TRIAL, TRIAL
add TRIAL, CALC
mov TRIAL, TRIAL
log TRIAL
log [TRIAL]

mov [TRIAL], 500
///////////////////////////////
PATCHERS_2:
bphwcall

gci JUMP_B, DESTINATION
cmp $RESULT, 0
jne RAS_4S
pause
pause

RAS_4S:
mov JUMP, $RESULT
mov NULLER, #00#

mov NEWPATCH, FRG
mov JUMP_2, FRG
cmp EXTRAADDRESS, 0
jne RAS_5S2

find eip, #0000000000000000000000000000000000000000000000000 00000000000000000000000000000000000000000000000000 000000000#
cmp $RESULT, 0
jne RAS_5S
pause
pause

RAS_5S:

mov NEWPATCH, $RESULT
mov JUMP_2, $RESULT

RAS_5S2:
opcode JUMP_B
mov FIRSTJUMP, $RESULT

mov [NEWPATCH], #833DEEEEEEEE02751D813DEEEEEEEE000500007505E9657F6 2EEC705EEEEEEEE00050000EBEFC705EEEEEEEE02000000EBE 3#
add NEWPATCH, 02
mov [NEWPATCH], HWID
add NEWPATCH, 09
mov [NEWPATCH], TRIAL
add NEWPATCH, 0A
eval "JMP {JUMP}"
asm NEWPATCH, $RESULT

add NEWPATCH, 07
mov [NEWPATCH], TRIAL
add NEWPATCH, 0C
mov [NEWPATCH], HWID

mov ADDRESS, JUMP_B

eval "JMP {JUMP_2}"
asm ADDRESS, $RESULT

eval "This are the bytes which you have to enter in Advanced Loader Generator!"
log $RESULT, ""
log "-----"

opcode ADDRESS
mov BINARYJUMP, $RESULT

find JUMP_2, #00000000#
cmp $RESULT, 0
jne RAS_6S
pause
pause

RAS_6S:
mov TESTER, $RESULT
sub TESTER, JUMP_2
mov TESTER, TESTER

opcode JUMP_B
mov BINARYJUMP, $RESULT

READSTR [JUMP_2], TESTER
mov BINARY, $RESULT

eval "Advanced Loader Generator DATA! \r\n\r\nAddress First Original \r\nVA: {ADDRESS} \r\nBytes: {FIRSTJUMP} \r\nAddress First Patched \r\nVA: {ADDRESS} \r\nBytes: {BINARYJUMP} \r\n\r\nAddress Second Original \r\nVA: {JUMP_2} \r\nBytes: {NULLER} x {TESTER} HEX Value \r\nAddress Second Patched \r\nVA: {JUMP_2} \r\nBytes: {BINARY} \r\n\r\nNOTE: {MEMO}"
log "Advanced Loader Generator DATA!"
MSG $RESULT
log ADDRESS
log FIRSTJUMP, ""
log ADDRESS
log BINARYJUMP, ""
log JUMP_2
log NULLER, ""
log JUMP_2
log BINARY, ""
jmp FILE
////////////////////
RISC_3:
pause
pause
ende_2:
mov TT_1, 0
msg "You have to enter minimum 5 digits for the address and also no strings so try it again!"
jmp start0
ende_3:
ret

[Deftron]

So this script can be compile using Olly? or maybe can also be compiled on other platform?

nice!!

[skyboi91]

Originally Posted by Deftron

So this script can be compile using Olly? or maybe can also be compiled on other platform?

nice!!

Botsea is down

well just run this script and it will show u all the patches address then u can make a loader for it using advanced loader generator.....
go to tuts4you.com forum script section LCF-AT tut there

Advanced Loader Generator Patches for TwinrNA2.0.18beta


NOTE: JUMP PATCH ADDRESS is INSIDE from our TARGET!YOU CAN CREATE A LOADER WITH THIS SCRIPT!

Address First Original

VA:
009AB849

Bytes:
E9 20BFFFFF

Address First Patched

VA:
009AB849

Bytes:
E9 3AAA0300

Address Second Original

VA:
009E6288

Bytes:
#00# x 00000025 HEX Value

Address Second Patched

VA:
009E6288


Bytes:
#81FAC3FD9900741581FA4B009A007405E9D114FCFFC702000 50000EBF3C70202000000EBEB#

[lanerjo]

this is the issue i am having when trying either method listed in this thread. It says file has stopped working. Would someone please help with this. The addresses given will not work for advanced loader generator either.

BTW you can get TwinR from twinrmy dot webs dot com.

Problem signature:
Problem Event Name: BEX
Application Name: TwinrNA2.0.18beta.exe
Application Version: 1.0.0.1
Application Timestamp: 496817d6
Fault Module Name: StackHash_1256
Fault Module Version: 0.0.0.0
Fault Module Timestamp: 00000000
Exception Offset: 79436be6
Exception Code: c0000005
Exception Data: 00000008
OS Version: 6.0.6001.2.1.0.768.3
Locale ID: 1033
Additional Information 1: 1256
Additional Information 2: a32ccc607030933e910834d26fa1546f
Additional Information 3: 0218
Additional Information 4: f55a2da5f3d58015ca4f34a6a4edf323

[goldencoolsam]

Is TwinR still updated and/or still working?
Because there is no point for me to try to crack TwinrNA if it doesn't work anymore.

[lanerjo]

yes twinr is still working i gave the most recent site for it