Add to Technorati Favorites

=========================================






- No CD Key Needed
- It's Genuine Windows

Includes:

All In 1 BootCD

Hiren's BootCD 9.0
All in one Dos Bootable CD which has all these utilities

Partition Tools

Partition Magic Pro 8.05
Best software to partition hard drive

Acronis Disk Director Suite 9.0.554
Popular disk management functions in a single suite

Paragon Partition Manager 7.0.1274
Universal tool for partitions

Partition Commander 9.01
The safe way to partition your hard drive,with undo feature

Ranish Partition Manager 2.44
a boot manager and hard disk partitioner.

The Partition Resizer 1.3.4
move and resize your partitions in one step and more.

Smart Fdisk 2.05
a simple harddisk partition manager

SPecial Fdisk 2000
SPFDISK a partition tool.

eXtended Fdisk 0.9.3
XFDISK allows easy partition creation and edition

GDisk 1.1.1
Complete replacement for the DOS FDISK utility and more.

Super Fdisk 1.0
Create, delete, format partitions drives without destroying data

Disk Clone Tools

ImageCenter 5.6 (Drive Image 2002)
Best software to clone hard drive

Norton Ghost 8.3
Similar to Drive Image (with usb/scsi support)

Acronis True Image 8.1.945
Create an exact disk image for complete system backup and disk cloning.

Partition Saving 3.40
A tool to backup/restore partitions. (SavePart.exe)

COPYR.DMA Build013
A Tool for making copies of hard disks with bad sectors

CD key: V2C47-MK7JD-3R89F-D2KXW-VPK3J
☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺



Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

=========================================


Microsoft Windows Vista Ultimate SP1 x86 x64 Activated | ISO | 3.92GB



This is a pre activated OEM edition of Windows Vista Ultimate with Service pack 1 for both x86 and x64 systems.


☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺
http://rapidshare.com/files/107181494/MSWVUSP1x86x64Activated.part01.rar
http://rapidshare.com/files/107193604/MSWVUSP1x86x64Activated.part02.rar
http://rapidshare.com/files/107205690/MSWVUSP1x86x64Activated.part03.rar
http://rapidshare.com/files/107214625/MSWVUSP1x86x64Activated.part04.rar
http://rapidshare.com/files/107258497/MSWVUSP1x86x64Activated.part05.rar
http://rapidshare.com/files/107297501/MSWVUSP1x86x64Activated.part06.rar
http://rapidshare.com/files/107318442/MSWVUSP1x86x64Activated.part07.rar
http://rapidshare.com/files/107338073/MSWVUSP1x86x64Activated.part08.rar
http://rapidshare.com/files/107498780/MSWVUSP1x86x64Activated.part09.rar
http://rapidshare.com/files/107566435/MSWVUSP1x86x64Activated.part10.rar
http://rapidshare.com/files/107571751/MSWVUSP1x86x64Activated.part11.rar
http://rapidshare.com/files/107576201/MSWVUSP1x86x64Activated.part12.rar
http://rapidshare.com/files/107580103/MSWVUSP1x86x64Activated.part13.rar
http://rapidshare.com/files/107584958/MSWVUSP1x86x64Activated.part14.rar
http://rapidshare.com/files/107589830/MSWVUSP1x86x64Activated.part15.rar
http://rapidshare.com/files/107594827/MSWVUSP1x86x64Activated.part16.rar
http://rapidshare.com/files/107602867/MSWVUSP1x86x64Activated.part17.rar
http://rapidshare.com/files/107606829/MSWVUSP1x86x64Activated.part18.rar
http://rapidshare.com/files/107610916/MSWVUSP1x86x64Activated.part19.rar
http://rapidshare.com/files/107740673/MSWVUSP1x86x64Activated.part20.rar
http://rapidshare.com/files/107748031/MSWVUSP1x86x64Activated.part21.rar
http://rapidshare.com/files/107755752/MSWVUSP1x86x64Activated.part22.rar
http://rapidshare.com/files/107767029/MSWVUSP1x86x64Activated.part23.rar
http://rapidshare.com/files/107780753/MSWVUSP1x86x64Activated.part24.rar
http://rapidshare.com/files/107795237/MSWVUSP1x86x64Activated.part25.rar
http://rapidshare.com/files/107815730/MSWVUSP1x86x64Activated.part26.rar
http://rapidshare.com/files/107820770/MSWVUSP1x86x64Activated.part27.rar
http://rapidshare.com/files/107825625/MSWVUSP1x86x64Activated.part28.rar
http://rapidshare.com/files/107829971/MSWVUSP1x86x64Activated.part29.rar
http://rapidshare.com/files/107837155/MSWVUSP1x86x64Activated.part30.rar
http://rapidshare.com/files/107840980/MSWVUSP1x86x64Activated.part31.rar
http://rapidshare.com/files/107844765/MSWVUSP1x86x64Activated.part32.rar
http://rapidshare.com/files/107848136/MSWVUSP1x86x64Activated.part33.rar
http://rapidshare.com/files/107851777/MSWVUSP1x86x64Activated.part34.rar
http://rapidshare.com/files/107855161/MSWVUSP1x86x64Activated.part35.rar
http://rapidshare.com/files/107858283/MSWVUSP1x86x64Activated.part36.rar
http://rapidshare.com/files/107861409/MSWVUSP1x86x64Activated.part37.rar
http://rapidshare.com/files/107864721/MSWVUSP1x86x64Activated.part38.rar
http://rapidshare.com/files/107868012/MSWVUSP1x86x64Activated.part39.rar
http://rapidshare.com/files/107871290/MSWVUSP1x86x64Activated.part40.rar
http://rapidshare.com/files/107873189/MSWVUSP1x86x64Activated.part41.rar

Password:full+free
☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺


Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

====
Windows XP Service Pack 3 / Student Edition FULL



Windows XP Professional SP 3 [Student Edition]
°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°°


- This version of Windows XP Pro will not ask you to activate.
It is a copy used in many colleges to teach students the installtion process of Windows XP.
It is, however, a full version of XP, and it has all the extras Windows XP is known to have.
This release will also allow you to log on to Microsoft.com and use Windows Update with no problem.
The CD is expected to be copied multiple times.

I hope you all enjoy this release and hopefully its the last release you will ever have to download.


** This is full and clean .ISO Image of Student Edition xpSP2,and I integrate SP3 - 5.1.2600.5512
,also i put in this clean version IE 7, and WMP 11 !!
It's full automated version what mean that you don't need tu write your seial,and DOMAIN(WORKGROUP)
but i leave to chose what Language you are using..,and Time zone
And one more time this is FULL version,and you can pass WGA from Microsoft,and also use WinUpdate !!

That's all from me !!

~~~~~~~
serial:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~



How To Use:
Burn the image using NERO.
CD is bootable.
Install as you would an original CD.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
################################################
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Microsoft Windows NT 5.1.2600 Service Pack 3
Windows XP Professional SP3 - 5.1.2600.5512 - English (United States)

** Modification
~~~~~~~~~~~~~~~~~

[Patches]
TcpIp = 100

[Hotfixes]
IE7-WindowsXP-x86-enu.exe
wmp11-windowsxp-x86-enu.exe

[Tweaks]
Explorer-Classic Control Panel
Internet Explorer-Set Homepage-www.google.com



MD 5 ---------------- > af72d4dd596d5ae90c8d4034589dfe17
SHA 1 --------------- > fa8891f6b3a2d17dccc6f06619d950dbfc5a8746
RIPEMD 160 ------- > 7fa1a0c6c6e03c1ae654f487ad69293f77e27395
CRC 32 ------------- > 16464f21
☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺
http://rapidshare.com/files/110676586/mtr_orpEps_pxniw.part1.rar

http://rapidshare.com/files/110691605/mtr_orpEps_pxniw.part2.rar
http://rapidshare.com/files/110709184/mtr_orpEps_pxniw.part3.rar
http://rapidshare.com/files/110716534/mtr_orpEps_pxniw.part4.rar
http://rapidshare.com/files/110720437/mtr_orpEps_pxniw.part5.rar
http://rapidshare.com/files/110724283/mtr_orpEps_pxniw.part6.rar
http://rapidshare.com/files/110674521/mtr_orpEps_pxniw.part7.rar
☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺

Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

=========================================




Windows XP SP3 final RTM version 5.1.2600.5512 has been released, and tandalone update installer package has been leaked for free download on the Web. For users ho intend to fresh install Windows XP with SP3 in clean install, there is now Windows XP installation CD slipstreamed or integrated with Service Pack 3.
WZT (WZTiSO) and other Windows enthusiasts have released Windows XP SP3 integrated setup CD ISO image that has been slipstreamed with the SP3. However, it’s not sure this version of Windows XP with SP3 bootable CD ISO image is a genuine leak from MSDN/TechNet or Microsoft source, or is an unofficial version that user self-make to slipstream SP3 into previous build of Windows XP, such as XP RTM, SP1 and SP2 (most likely the later is the case). Whatever, using the CD will install Windows XP SP3 version 5.1.2600.5512 intoo your
computer.
Windows XP SP3 CD ISO images above are Professional edition for corporate VOL customers on volume licensing, which should be installed using a volume license product key (VLK) that bypass activation. All downloads require a BT client such as uTorrent, BitComet, ABC and etc.
Windows XP Service Pack 3 (SP3) final version has been packed, published, and released to manufacturing on April 21, 2008 US time. However, only Original Equipment Manufacturers (OEM channel) will have access to the code bits of Windows XP SP3, while general public can starts download from April 29 onwards, as scheduled. Windows XP SP3 has final version of 5.1 and build number 5512 (5.1.2600.5512), a little higher than Windows XP RC2 Refresh (v.5508), but not the speculated build 5573. Chris Keroack, Release Manager for Windows XP Service Pack 3 from Windows Serviceability section says the following on TechNet forum:
Today we are happy to announce that Windows XP Service Pack 3 (SP3) has released to manufacturing (RTM). Windows XP SP3 bits are now working their way through our manufacturing channels to be available to OEM and Enterprise customers.
We are also in the final stages of preparing for release to the web (i.e. you!) on April 29th, via Windows Update and the Microsoft Download Center. Online documentation for Windows XP SP3, such as Microsoft Knowledge
Base articles and the Microsoft TechNet Windows XP TechCenter, will be updated then. For customers who use Windows XP at home, Windows XP SP3 Automatic Update distribution for users at home will begin in early summer.
Thanks to everyone here who installed the public betas – you not only gave us detailed feedback but also helped each other out with timely troubleshooting. Through the beta program we found several important issues and were able to confirm some essential fixes. We couldn’t have done this without you.
We will still be monitoring this forum during the next few weeks in case you have more feedback about the release of Windows XP SP3.
On behalf of myself, Shashank Bansal and Windows Serviceability, many thanks.
Chris Keroack also confirmed that build number for Windows XP SP3 is 5512.
Standalone update package for Windows XP SP3 has leaked, and users can now download Windows XP SP3 setup installer via torrent or HTTP download. Or download Windows XP with SP3 integrated.
The CD disc image for Windows XP SP3 and standalone installer package downloaded via Microsoft Download Center has the size of roughly 580 MB, while download via Windows Update starts from 70 MB. The service pack 3 only intends for 32-bit edition of Windows XP, and not applicable to the 64-bit version of Windows XP. It can be installed on Windows XP with base install of SP1 or SP2, and works with any edition of XP. It’s also reported that system installed with Windows XP SP3 RC v.3300 or later can upgrade directly to final version of SP3 without need to uninstall beta or release candidate versions of XP SP3.
Microsoft has published an official Windows XP SP3 release schedule timeline by distribution channel that confirm previously reported that Windows XP SP3 is released to manufacturing (RTM) on April 21st, 2008, and will be released to web (RTW) on April 29th 2008 (US Time).


Windows XP SP3 Final Build 5512 Release Schedule Timeline by Channelss
RTM (Release to Manufacturing): April 21, 2008
OEM Channel: April 21, 2008
Windows Update: April 29, 2008
Download Center: April 29, 2008
MSDN/TechNet Download: May 2, 2008
Windows XP SP3 Fulfillment Media: May 19, 2008
VL Customers via Download: June 1, 2008
Automatic Updates: June 10, 2008

☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺
http://rapidshare.com/files/109956752/WindowsXP-KB936929-SP3-x86-ENU.exe.001
http://rapidshare.com/files/109956812/WindowsXP-KB936929-SP3-x86-ENU.exe.002
http://rapidshare.com/files/109956914/WindowsXP-KB936929-SP3-x86-ENU.exe.003
http://rapidshare.com/files/109956370/WindowsXP-KB936929-SP3-x86-ENU.exe.004

To Join Files use Total Commander Or HJ-Split :
Code:
http://www.download.com/HJ-Split/3000-2248_4-10550267.html

☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺


Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

=========================================

Vista Drivers and XP Drivers are at your fingertips when you use Driver Detective software and service. Drivers HeadQuarters is the first and only driver update service providing manufacturer specific drivers for your computer. Driver Detective is simple and easy to use and designed to make updating drivers fast. Drivers HeadQuarters has an experienced support staff available to help you, with integrated customer support tools built in. Driver Detective can save you endless hours of work and aggravation updating your drivers.



☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺
Download Driver Detective

☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺ ☺☺ ☺




Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

=========================================
Exploiting File and Print Sharing, by:
Ghost_Rider (Ghost_Rider9@hotmail.com)
R a v e N (barakirs@netvision.net.il)
Date of Release: 2/4/2000
http://blacksun.box.sk
Thanks to Oggy, a totally kewl and helpful guy that helped us release this
tutorial faster.

-------------
Introduction
-------------

Remember that I won't go into much detail, because it could start getting
too complicated to explain to newbies. This is a newbies guide after all. If
you want more detailed information about file sharing search the web, or
read some good NT networks administration books.

Windows has an option called file and print sharing. You can use this
option in order to "share" drive and printers, which means giving access to
files and printers to other people - people on your own network, specific
IPs or even the whole world. When you turn this option on, you leave an open
port (port number 139) that accepts connections and understand the "NetBIOS
protocol", a set of commands (a "language") used to access remote file
and print sharing servers, so that other computers can access the files or
printers you decided to share.
Now sometimes in a small company LAN this could be extremely useful. For
example, instead of having a seperate printer for each computer, there's just
one central printer in a computer that allows file and print sharing. But if
you are using file sharing in your home computer (We've seen many people
that have this option turned on and don't even know what it means! Poor
souls) that is connected to the Internet, that could be quite dangerous because
anyone who knows your IP can access your files or printers you're sharing.
If you don't know if file sharing is active in your computer just go to the
control panel and select the Network icon. Now you should see a box where you
can see all the network software that you have installed, such as TCP/IP
(Transfer Control Protocol / Internet Protocol. This is the protocol that is
used to transfer data packets over the Internet. A protocol is like a human
language - if two computers understand it, they can communicate) and probably a
dial-up adapter (so you could transfer TCP/IP packets over a PPP connection.
PPP, or Point to Point Protocol is the protocol used in dial-up connections),
check if you have a line called File and Printer Sharing.
If you have this then you have sharing activated, to turn it off just uncheck
the "I want to be able to give others access to my files" and do the same to
the other. Let's return to the ports thing. Remember port 139? The File Sharing
Port is port 139 and it's called NetBIOS Session Service port. When you have
this option enabled you also have 2 other ports open but they use the UDP
protocol instead of the TCP protocol. These ports are 137 (Name Service) and
138 (Datagram Service). Now if you know anything about DoS attacks (known to
many as nukes) port 139 should sound familiar... There's a kind of DoS (stands
for Denial of Service) attack called the OOB nuke (OOB stands for Out Of Band)
or "winnuke" that sends an OOB packet to port 139 and makes Windows lose
connection and drop the user to "blue screen mode". If you wish to know more
about DoS attacks, I suggest that you wait for the DoS attacks tutorial (at the
time this tutorial was written, the DoS attacks tutorial didn't exist yet.
However, by the time you read it it might already be available, so you can try
and get it from http://blacksun.box.sk).
Okay, enough said, let's get on with it.
----------- Getting In -----------

I'm going to explain two ways of breaking into a Windows box that has file
sharing enabled. Just to see how unsafe Windows is, the programs you'll need
come with Windows. isn't that ironic? Okay, of course they come with Windows!
Would you actually expect Microsoft to release an OS that supports sharing
without the tools to access shares?
Now, of course, you can hack file and print sharing through Unix as well.
We'll get to that in the end. Right now we're dealing with Windows here.
Both ways will have equal starts but then in one of the ways you'll keep
typing commands, and in the other way you'll use a GUI (for the ppl who
don't know GUI stands for Graphical User Interface) software. The programs
that you need are called Nbtstat.exe and Net.exe you can find it in the windows
directory. These programs run from the MS-DOS prompt. To see the help menu
for nbtstat type nbtstat /? And for net type net /?. Now if you are using
Windows 95 you can have the option NetBios Over TCP/IP disabled and with
that disabled nbtstat won't work and will display a error message like this
one: "Failed to access NBT driver" without the quotes. So if this error
message comes up just go to the control panel, and select the network icon. Now
select TCP/IP and choose properties, in the TCP/IP properties box select the
NetBIOS sheet, and enable it checking the box that shouldn't have a cross. If
you have Windows 98 the error message shouldn't be displayed unless you have
some kind of a port blocker on port 139 (such as Nukenabber). A lot of people
have these things on to detect OOB nuke attempts (usually newbies that can't
use a firewall or lamers that never attempted to. Hopefully not you).
Now, you must be thinking that enabling NetBIOS over TCP/IP opens the same
three ports, that you use to access a computer. That's true, because if you
want to use the same protocol you'll need to use the same default ports, or
you can use a terminal emulator to connect to port 139 and instead of using
the application I mentioned to type the protocol commands, but that's a real
pain in the ass. Remember that there isn't any problem with the file sharing,
because you don't have it enabled, you've just got the ports open (you are
just vulnerable to the DoS attack, you can use a firewall or get a patch for
it at www.theargon.com (click on defenses and find the OOB patch), but I don't
know if that would block the incoming data from the host that you are trying
to get in).

Now that you have your NbtStat.exe ready to roll, choose the computer. You
can use the hostname or the IP but you need to use different switches (I'll get
to that in a second).
Let's suppose for a second that this computer's hostname is
Mycomputer.MyIsp.com and the IP is 194.65.34.3. The first thing you need to do
is to see if the computer has file sharing enabled. How can you do that? It's
easy. Type:
nbtstat -a hostname
In this case nbtstat -a Mycomputer.MyIsp.com, but if you want to use the IP
you need to type:
nbtstat -A IP
In this case nbtstat -A 194.65.34.3
That's strange because DOS isn't case sensitive... but that's how things work
(I guess that although DOS isn't case sensitive, this rule doesn't apply to
command parameters. Makes more sense than the opposite).
Now you might receive two different kinds of replies. One that just says
"Host Not Found". If you get this message, you can give up trying to access
the share part of that computer, because that computer hasn't got the NetBIOS
protocol enabled, or you mistyped the hostname or IP. On the other hand, if
you get a table with names, type of sharing and status, it might be your lucky
day! Now if you get this table you're half way in. But remember that
sometimes you will get that table but you will not be able to do anything
productive with it, because the computer won't be sharing anything.
The table should look something like the one that is below:

Name Type Status
-----------------------------------------------------------------------------
Host <20> UNIQUE Registered
Hostbug <00> GROUP Registered
Host machine <03> UNIQUE Registered


-----------------------------------------------------------------------------
If you want to access your own sharing table just type nbtstat -n

-----------------------------------------------------------------------------
The values in the brackets can be:
00 base computernames and workgroups, also in "*" queries
01 master browser, in magic __MSBROWSE__ cookie
03 messaging/alerter service; name of logged-in user <--- This one is cool too --- 20 resource-sharing "server service" name <--- Check this one --- 1B domain master-browser name 1C domain controller name 1E domain/workgroup master browser election announcement [?] ------------------------------------------------------------------------------- I'll talk about messaging/alert service later, if you want to read about it now, just scroll down until you find Messaging/Alert Service. ------------------------------------------------------------------------------- So if the value in the box is 20 (by the way, the values are displayed
in hex code) it means that there is sharing enabled. So now how can someone
get in? Easy. First you need to create an entry in your Lmhosts file (can be
found at c:\windows\Lmhosts. There is also an example file at
c:\windows\Lmhosts.sam. In Windows NT, these files can be found at
c:\WinNT\Lmhosts and c:\WinNT\Lmhosts.sam). If you don't have the Lmhosts file,
just create it. Read all the information in the sample file file below.

--- Lmhosts.sam file ---
# Copyright (c) 1993-1995 Microsoft Corp.
#
# This is a sample LMHOSTS file used by the Microsoft TCP/IP for Windows
# NT.
#
# This file contains the mappings of IP addresses to NT computernames
# (NetBIOS) names. Each entry should be kept on an individual line.
# The IP address should be placed in the first column followed by the
# corresponding computername. The address and the comptername
# should be separated by at least one space or tab. The "#" character
# is generally used to denote the start of a comment (see the exceptions
# below).
#
# This file is compatible with Microsoft LAN Manager 2.x TCP/IP lmhosts
# files and offers the following extensions:
#
# #PRE
# #DOM:
# #INCLUDE
# #BEGIN_ALTERNATE
# #END_ALTERNATE
# \0xnn (non-printing character support)
#
# Following any entry in the file with the characters "#PRE" will cause
# the entry to be preloaded into the name cache. By default, entries are
# not preloaded, but are parsed only after dynamic name resolution fails.
#
# Following an entry with the "#DOM:" tag will associate the
# entry with the domain specified by . This affects how the
# browser and logon services behave in TCP/IP environments. To preload
# the host name associated with #DOM entry, it is necessary to also add a
# #PRE to the line. The is always preloaded although it will not
# be shown when the name cache is viewed.
#
# Specifying "#INCLUDE " will force the RFC NetBIOS (NBT)
# software to seek the specified and parse it as if it were
# local. is generally a UNC-based name, allowing a
# centralized lmhosts file to be maintained on a server.
# It is ALWAYS necessary to provide a mapping for the IP address of the
# server prior to the #INCLUDE. This mapping must use the #PRE directive.
# In addtion the share "public" in the example below must be in the
# LanManServer list of "NullSessionShares" in order for client machines to
# be able to read the lmhosts file successfully. This key is under
#
\machine\system\currentcontrolset\services\lanmanserver\parameters\nullsessionshares
# in the registry. Simply add "public" to the list found there.
#
# The #BEGIN_ and #END_ALTERNATE keywords allow multiple #INCLUDE
# statements to be grouped together. Any single successful include
# will cause the group to succeed.
#
# Finally, non-printing characters can be embedded in mappings by
# first surrounding the NetBIOS name in quotations, then using the
# \0xnn notation to specify a hex value for a non-printing character.
#
# The following example illustrates all of these extensions:
#
# 102.54.94.97 rhino #PRE #DOM:networking #net group's DC
# 102.54.94.102 "appname \0x14" #special app server
# 102.54.94.123 popular #PRE #source server
# 102.54.94.117 localsrv #PRE #needed for the
include
#
# #BEGIN_ALTERNATE
# #INCLUDE \\localsrv\public\lmhosts
# #INCLUDE \\rhino\public\lmhosts
# #END_ALTERNATE
#
# In the above example, the "appname" server contains a special
# character in its name, the "popular" and "localsrv" server names are
# preloaded, and the "rhino" server name is specified so it can be used
# to later #INCLUDE a centrally maintained lmhosts file if the "localsrv"
# system is unavailable.
#
# Note that the whole file is parsed including comments on each lookup,
# so keeping the number of comments to a minimum will improve performance.
# Therefore it is not advisable to simply add lmhosts file entries onto the
# end of this file.

To create an entry just open the Lmhosts file in your favorite word
processor and enter your target's IP, press tab and enter the share name
(the one that is listed in the name field). Save the file and exit.
Now the are two methods to access the remote shares you're after: the
easy way and the cool way.



--- The easy way (GUI) ---

If you don't want to have any more trouble just press start, click find
and select find computer. Enter the target's IP address. If your Lmhosts entry
is correct, it will show the computer you want in the search window. Just click
on the computer icon, and start browsing through that computer like you were
browsing your own computer.

--- The cool way ---

Now it's time to get to know the net.exe program. To access the help menu
just type:
net /? (in a dos Window).
I suggest to redirect all the help to a file and then read it
(use net /? > somefile.txt to redirect all output to somefile.txt and overwrite
it, or net /? >> somefile.txt to append the output to the file without deleting
it). You can also do net option /? to get more help about that option. To
access the share, you create a virtual drive that will be the share in the
other host.
In order to do this you will need to enter:
net use drive \\[ipaddress]\[sharename]

Where:

- drive is the drive letter you want. For example f: g: z:
- ipaddress is the target host's IP

- sharename is the name of the share (remember the table we discussed about
before?)

After doing this you just need to type drive: and then browse the new drive
using Ms-DOS like if you were in your own hard disk (for example, type:
f:
If your new virtual drive has been assigned the letter f).


Example:

Lets say that you coded a *really cool* backdoor, and you want to run on a
computer that has share enabled, the share name is Flintstone and the ipaddress
is 145.42.23.14 .

c:\>net use f: \\145.42.23.14\Flinstone

Now you would just need to copy the backdoor to the new virtual
drive.

c:\>copy backdoor.exe f:\backdoor.exe

----- First Version Text ------

Then you would just change drive and run the backdoor.

c:\>f:
f:\>backdoor.exe

And the backdoor is loaded, so now you can use it to access this computer.

--------------------------------
I'm deeply sorry, but what is written between the ----First Version Text---
is wrong.
Using what is there what probably would happen was installing the backdoor
in your own computer and not in the target host. Thanks to Kimmo from the
a-Men Group that correct me.
What you really need to do is to copy the backdoor.exe file to the share,
and then edit the win.ini file adding the line:

run=%SystemRoot%\backdoor.exe

---------------------------------------------------------------------------------
NOTE: Why %SystemRoot% ?
We need to use %SystemRoot% instead of F:, because F: is a virtual drive so
in the the host that drive could not exist, so you use the variable
%SystemRoot% that will return the correct drice.
---------------------------------------------------------------------------------

Of course, you can also put the backdoor in other places, such as
c:\windows\winstart.bat (enter the line %SystemRoot%\backdoor.exe as a new
blank line). If there is no such file, create it.

-----------------------
Messaging/Alert Service
-----------------------

What's this feature? It doesn't let you access the files for certain, but
it's kinda fun, because what it does is send a message, in Message Box Format
to the other host. Watch the face of the guy that is on the computer when he
sees a message box saying "Error: User To Stupid". However, you need to
remember that your host will be shown in the message box, but if you spoof your
host, you can have a good laugh with this.
When using this feature you also need to create a new entry in your Lmhosts
file. Remember that this can only be used in a LAN network such as a school LAN
with your friends, just to see their faces, nothing more. Even if you wanted to
send it over the Internet you couldn't because it uses a broadcast system, and
when any broadcasted packets get to a router they are immediately deleted
(security reasons. Off the topic of this tutorial).
To send a message to the other computer that computer needs to have a <03>
value. As you can see in the table somewhere in the middle of the file, <03>

Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

Add to Technorati Favorites

=========================================
SECRETS OF LOCK PICKINg
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

Well, I'm bringing you this file because I have a scanner and an
OCR package and I like to pick locks. This file is a complete transcription
of the book, Secrets of Lock Picking by Steven Hampton, minus the chapter
on warded locks (These locks are cheap. Use a hammer and a screwdriver).
Before getting on to the subject, I would just like to use this opportunity
to say that you can not just read this file and know how to pick locks. It
does take practice. The good news is that by practicing you will learn how
to open locks. And fast, too. I have heard many people say "It's not like
the movies...it takes time to pick a lock." Well, sometimes thats true, but
I have picked a Sargeant six-pin, high-security tumbler lock in three seconds.
And other similar locks in the the same time frame as well. So I know that
it can be done. But don't worry. Practicing is not boring. There is a
certain thrill present when you pick a lock for the very first time.
Imagine the sensation of knowing that you can get into almost anywhere you
want. Believe me when I tell you that it is very cool.

%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Contents
Introduction
Tools
Lock Identification
Pin Tumbler Locks
Wafer Tumbler Locks
Double Wafer Locks
Pin and Wafer Tumbler Padlocks
Tubular Cylinder Locks
Mushroom and Spool Pin Tumbler Locks
Magnetic Locks
Disk Tumbler Locks
Tips for Success

INTRODUCTION

The ancient Egyptians were the first to come up with
a complicated security device. This was the pin tumbler
lock. We use the same security principle today on millions
of applications.

The most commonly used lock today is the pin tumbler
lock. A series of pins that are divided at certain points
must be raised to these dividing points in relationship to
the separation between the cylinder wall and the shell of
the lock by a key cut for that particular series of pin divi-
sions. Thus the cylinder can be turned, and the mechanism
or lock is unlocked.

Lock picking means to open a lock by use of a flat piece
of steel called a pick. Actually, the process requires two
pieces of flat steel to open cylinder locks. It amuses me
to watch spies and thieves on TV picking locks using only
one tool. But it is for the better in a sense. If everyone
learned how to pick locks by watching TV, we would all
be at the mercy of anyone who wanted to steal from us,
and the cylinder lock for the most part would be outdated.

The actual definition of lock picking should be: "The
manipulation and opening of any restrictive mechanical
or electronic device by usage of tools other than the
implied instrument (key or code) used solely for that
device." A little lengthy, but more accurate description.
With cylinder locks, it requires a pick and a tension
wrench.

By picking the lock, you simply replace the function
of a key with a pick that raises the pins to their "break-
ing point," and using a tension wrench one rotates the
cylinder to operate the cam at the rear of the lock's cylinder
to unlock the mechanism.

(See Fig-01.GIF)

The tension wrench is used to apply tension to the
cylinder of the lock to cause a slight binding action on
the pins as well as to turn the cylinder after the pins have
been aligned by the pick; this opens the lock. The slight
binding action on the pins caused by the tension wrench
allows one to hear and feel each pin as it "breaks" or
reaches alignment with the separation of cylinder and
shell. The vibration is felt in the knuckles and joints of
the fingers, and the sound is similar to that of a cricket
in an arm wrestling match-a subtle yet distinct click.

Usually you need very little tension with the wrench
while picking the lock. In fact, it takes somewhat of a
delicate, yet firm touch. This is the secret to picking locks
successfully-a firm and yet gentle touch on the tension
wrench. You should be able to feel the pins click into place
with the right amount of tension; experience will be your
true guide.

Half of your success will be based on your ability to
use or improvise various objects to use as tools for your
purpose. The other half will depend on practice. I once
picked a pin tumbler lock using a borrowed roach clip
and a hairpin. A dangerous fire was prevented and prob-
ably several lives were saved. The world is full of useful
objects for the purpose, so never hesitate to experiment.




TOOLS


I started picking locks using a small screwdriver and
a safety pin. The screwdriver can be used as a tension
wrench, and the safety pin is used like a "hook" pick.
The last half inch of the screwdriver's tip was bent at a
45 degree angle so as to allow easy entry for the pick (bent
safety pin). Do not heat the screwdriver tip to bend it,
as this will destroy its temper. Use a vise and hammer to
do the job. Bend slowly by using firm and short taps of
the hammer, otherwise you may break and weaken the
shaft. The safety pin should be about one and a half inches
long and bent in the same way.

With the small screwdriver as a tension wrench, you can
use more of a turning or twisting movement than with
a regular tension wrench so you will generally need less
direct force when using it. As I mentioned earlier, with
practice you will develop the feeling for the right amount
of tension on a cylinder. If the safety pin bends after a
short time, use the keyway of the lock you are picking
to bend it back into shape. Even after several times of
bending, it should still be useful. Keep a few spares handy,
though. File the tip of the safety pin flat in relationship
to the bottom of the pins in the lock. Smooth any sharp
edges so that you won't impale yourself. Also, if the tip
is smooth, the pick will not get hung up on the pins while
picking the lock.

Granted these are not the best tools for the job, but
they do work. If you learn to use your junk box as a rich
source of equipment, then with your experience real lock
picks will give you magic fingers. Also, you'll have the
advantage of being able to improvise should you be
without the real things (which are illegal to carry on your
person in most parts of the country).

Lock picks are difficult to get. I received my first set
when I became a locksmith apprentice. All of my subse-
quent sets I made from stainless steel steak knives with
a grinder and cut-off wheel. They are much more durable
than the commercial picks. If you do make your own,
make certain that the steel is quenched after every 3
seconds of grinding-do not allow the pick to get hot to
the point of blue discoloration.

A diamond pick is the standard pick I use on most all
pin and wafer locks. A small diamond pick is used for
small pin tumbler locks such as small Master padlocks,
cabinet file locks, etc. The tubular cylinder lock pick, we
will discuss later. The double-ended, single-pronged ten-
sion wrench is used with the diamond pick. It features
double usage; a small end for small cylinders and a large
end for the larger cylinders. A special tension wrench is
used for double-wafer cylinder locks with an end with two
prongs on one end and tubular cylinder locks with the
single prong on the other end. We will discuss tubular
cylinder and double-wafer locks later as well. The steel
should be .030 inches to .035 inches thick for the picks
and .045 inches to .050 inches thick for the first tension
wrench mentioned above. The second tension wrench
should be .062 inches square (.062 inches x .062 inches)
on the tubular cylinder side (one pronged end), and .045
inches thick on the double-wafer end (two-pronged end).
You can accomplish this by starting out with .045 inches
in thickness. The two-pronged end should be bent carefully
in a vise at a 30 degree angle. This allows easy entry for
the pick on double-wafer locks.

(See fig-02.GIF)

Among the more common tools used by professionals
around the world is the rake pick. The rake pick is used
to "rake" the tumblers into place by sliding it in and out
across the tumblers. I seldom use the rake pick because
it is not highly effective and I consider it a sloppy excuse
for a lock pick. I've seen the rake pick work on some dif-
ficult locks, but you can rake with a diamond pick and
get the same results. I prefer the diamond pick for most
tumbler locks simply because it is easier to get in and out
of locks-it slides across the tumblers with little or no
trouble.

A ball pick is used for picking double-wafer cylinder
locks, though I never carry one; I use a large diamond
pick and reverse it when picking these locks. This means
I have one less pick to carry and lose.

(See fig-03.GIF)

A double-ball pick is used like a rake on double-wafer
locks in conjunction with a tension wrench (two-pronged
end).

A hook pick is used to open lever tumbler locks, though
again, I use a diamond pick with a hooking action when
possible. There are various sizes of hooks but they all have
the same basic job-to catch the movable levers that
unlock lever locks.

There are also various sizes of tension wrenches. They
are usually made from spring steel. The standard tension
wrench is used for pin and wafer locks. A special tension
wrench is called a Feather Touch, and it is used for high-
security mushroom and spool pin tumbler locks. Its
delicate spring-loaded action allows the pick to bypass the
tendencies of these pins to stick. A homemade version of
the Feather Touch can be made from a medium-light duty
steel spring.

As to getting lock picks for your own use, you cannot
go down to your local hardware store and buy them. I
could supply you with some sources or wholesalers, but
I do believe it is illegal for them to sell to individuals. Your
best bet would be to find a machine shop that will
fabricate them for you. It would be less expensive and
arouse less suspicion if you purchase a small grinder with
a cut-off wheel and make your own. With a little prac-
tice, you can make a whole set in an afternoon. Use a copy
of the illustrations in this book as templates and carefully
cut them out with an X-ACTO knife. Cut down the middle
of the lines. Acquire some stainless steel (many steak
knives approach proper thickness).

With a glue stick, lightly coat one side of the paper
template and apply it to the cleaned stainless surface, and
allow it to dry. You'll need a can of black wrinkle finish
spray paint. This kind of paint has a high carbon con-
tent and can stand high temperature of grinding. Spray
the stainless (or knives) with the patterns glued on and
dry in a warm oven or direct sunlight for one hour. Set
aside for twenty-four more hours. Peel off the paper
template and you are ready to cut and grind. Please use
caution when cutting and grinding. The piece should be
quenched every three seconds in cold water. Smooth up
sharp edges with a small file or burnishing wheel.

Tools made from stainless steel will outlast the pur-
chased ones. The tools purchased from most suppliers are
made from spring steel and wear out after about 100 uses.
The stainless steel ones, if properly made, should last over
2,000 uses.



LOCK IDENTIFICATION


There are many types of locks, the most common being:

1. The pin tumbler lock. Used for house and garage doors,
padlocks, mail boxes, and Ford automobiles.

2. The wafer tumbler lock. Used for garage and trailer
doors, desks, padlocks, cabinets, most autos, window
locks, and older vending machines.

3. The double-wafer lock. Used for higher security wafer
tumbler applications.

4. The warded locks. Used for light security padlocks and
old-fashioned door locks.

5. Lever locks Used for light security and older padlocks,
sophisticated safe-deposit boxes, some desks, jewelry
boxes, and small cash boxes.

6. Tubular cylinder locks. Used for alarm control systems,
newer vending machines, car-wash control boxes and
wherever higher security problems might exist.

These locks are the more common locks used yet there
are variations and combinations of these principal types
that usually pick open in the manner that will be discussed.
Some of them just require practice of the basic types,
others luck, and most of the rest of them knowledge of
how that particular lock works and is keyed. This comes
from experience.

(See fig-04.GIF)


PIN TUMBLER LOCKS



Pin tumbler locks offer the most security for their price.
They have close machine tolerances and approximately
1,000,000 different key combinations for a five-pin lock.
Considering the thousands of different companies mak-
ing pin tumblers (different shaped keyways for each com-
pany or design line), the chances of someone having a key
that will work in your front door lock are one in many
billions.

Pin tumbler locks can easily be identified by peering
down the keyway and locating the first round pin.

Sometimes you can see the pin's dividing point, where it
breaks with the cylinder wall (shear point).

To successfully pick a pin tumbler lock, your sense of
touch sould be honed so that both hands feel the tools.
Once the hand holding the pick has located a slight relief
in tension while picking a particular tumbler, the other
hand holding the tension wrench will feel a relief or break-
ing point. Both hands should be involved with the sense
of touch, the sensing of the inner workings of the lock.

We are now ready to begin the first lesson. First open
your front door and check for a pin tumbler lock on it.
It should have one on it. If there is one, leave the door
open to decrease suspicion. Do not lock yourself out of
your apartment or house by being overconfident; not only
will you raise suspicion, but window glass is not cheap.

HOW TO PICK A TUMBLER LOCK

STEP ONE

Without using the tension wrench, slip the pick into
the lock. The "hook" of the pick should be toward the
tumblers (up in most cases, depending on whether or not
the lock was mounted upside down-you can tell by look-
ing down the keyway and locating the first pin with your
pick). Try to feel the last tumbler of the lock. It should
be 7/8 inches into the lock for a five-pin tumbler lock
(most common pin tumbler lock used).

Make certain that you have no tension on the wrench
when inserting the pick as this will encumber the frontal
tumblers. When you feel the back tumbler, slowly raise
it with a slight prying motion of the pick. Release it, but
keep the pick in the lock on the rear tumbler.

Now insert the tension wrench, allowing room for the
pick to manipulate all of the pins. It should be placed at
the bottom of the cylinder if the lock was mounted
upright, tumblers toward the top of the cylinder. Apply
firm and yet gentle clockwise pressure to the tension
wrench.

Slowly raise the back tumbler with a slight prying mo-
tion of the pick. A minute click will be felt and heard when
it breaks. It will lose its springiness when this occurs, so
do not go any further with it. Any further movement with
the pick will cause binding by going past the pins' shear
line. Continue an even pressure with the tension wrench.

Keeping an even tension pressure, proceed to Step Two.

STEP TWO

The fourth tumbler should be easily felt since it is the
next one in line. Raise it until it breaks, keeping the ten-
sion wrench steady. It too will give a sound and sensa-
tion when it breaks or aligns.

STEP THREE

The third or middle tumbler is next. Again, it too will
click. Maintain a constant, even pressure on the wrench-
about the same pressure that you would use to replace
a cap on a catsup bottle. You may feel the "clicks" in your
tension wrench as well as hear them.


(See fig-05.GIF)


STEPS FOUR AND FIVE

Continue on to the next tumbler out, working toward
you. When it breaks, raise the last (front) tumbler to its
braking point and the cylinder should be free to rotate
and unlock the door. Sometimes you may have to play
with the wrench to open the lock because you may have
raised a tumbler too high, past its breaking point. If this
is the case, very slowly and gradually release the tension
wrench pressure and the overly extended tumbler will drop
into its breaking point before the other tumblers have a
chance to fall. The cylinder should pop open at that point.
I have found that this technique is responsible for over
30 percent of my successes in opening all tumbler locks.

If the lock still refuses to open after all that treatment,
release the tension wrench pressure, allowing all of the
tumblers to drop and start over. You may have more than
one tumbler too high and would be better off to repeat
the picking process.


WAFER TUMBLER LOCKS


Wafer tumbler locks make up over one-fourth of the
locks in use in the world. Since they are generally easier
to pick than most pin tumbler locks, you will be 75 per-
cent master after fooling around with these mechanisms.
That is why I wrote about pin tumbler locks first-they
are more difficult and make up over one-half of the locks
used today.


(See fig-06.GIF)

The term wafer refers to the general shape of the
tumblers. The wafers are flat, spring-loaded tumblers that
are much thinner than pins and the distance between them
is less. Wafer locks are picked in the same way as pin
tumbler locks, but you must compensate for the smaller
dimensions. You can identify wafer locks simply by look-
ing down the keyway and locating the first flat tumbler.
The last tumbler on most wafer locks is located about one-
half inch into the lock.

Wafer locks are used on filing cabinets, lockers, most
cars, garage doors, desks, and wherever medium security
is required. The only wafer tumbler lock in common use
that is difficult to pick is the side-bar wafer lock. It is the
most popular type of auto lock. This lock is of different
design than most other locks and offers much more secur-
ity than a regular wafer tumbler lock, or even a pin
tumbler lock.

The side bar lock is used mostly on General Motors
cars and trucks since 1935. It is used on ignitions, door,
and trunk locks. Side bar locks are hard to pick because
you cannot feel or hear the tumblers align with the
cylinders breaking point. A spring-loaded bar falls into
place to allow the cylinder to turn when all of the tumblers
are aligned. There is no way to tell when that happens.
One learns to sense the bar while picking so that it seems
to fall into place by itself. But for beginners, I recommend
this technique for emergency openings: Peer down the
keyway and locate the side groove of any of the tumblers
using a pick as a searching tool. Drill a small hole in the
shell of the lock above the bar which is above the grooves
on the tumblers. Since side bar locks have off-centered
keyways, the usual place to drill is opposite of the keyway.
Using an L-shaped steel wire, put pressure on the sidebar
and rake the tumblers using a tension wrench for cylinder
rotation and the lock will open.

Fortunately, most GMC autos have inferior window
seals; with a coat hanger, one can lasso the locking door
knob to open the door. If you are going to be successful
at opening side bars, you will do it within two minutes;
otherwise, you are causing unnecessary wear on your picks
not to mention wasting your time.

Ford auto locks are relatively simple to pick. They have
pin tumblers and you have to remember that the door
locks turn counterclockwise. Most other auto locks turn
clockwise. If you are not sure, remember this: If the
tumblers will not catch at their breaking points, you are
going in the wrong direction with the tension wrench.

Wafer locks are a cinch to pick if you have learned how
to pick pin tumblers. Just remember that wafers are thin-
ner than pins and there is less distance between them.

Generally you need less tension-wrench pressure with these
locks, yet car locks can be quite stubborn and require a
great deal of tension. Any heavily spring-loaded cylinder
needs a substantial amount of tension.

As a rule, though, wafer locks need less play with the
tension wrench than with pin tumbler locks. But if you
find yourself having difficulty in opening these, you may
try a little tension-wrench play. Usually they won't pop
open like pin tumbler locks, they just slide open; you don't
get the warning that a pin tumbler gives before it opens
because there is less contact area on the wafer's edge than
on a pin, so the sense of climax is reduced with these types
of locks. Still, they open quite easily.


DOUBLE WAFER LOCKS


Double-wafer locks are picked in the same way as single-
wafer locks, but there are two sides to the story. Not only
do you have to align the top wafers, but you have ones
in the bottom of the cylinder to align as well.

The Chicago Lock Company was the first to come up
with this type of lock. It is a classic example of the race
toward better security. Certain tension wrenches allow
uninterrupted picking using ball picks. You can also use
a standard tension wrench or small screwdriver and place
it at the center of the keyway. To eliminate unnecessary
baggage, use a diamond pick, reversing it to encounter
both top and bottom wafers.


(See Fig-07.GIF)


The last tumbler in this type of lock is located less than
one-half of an inch in. The picking procedure may have
to be repeated more than one time-top wafers, then bot-
tom wafers, top, bottom-back and forth. Yet these locks
are easier to pick than most pin tumblers.

Locate the last wafer on the top side and move it to
its breaking point. Do the same with the other top wafers.
Keep the tension wrench firm, remove the pick, turn it
upside down (if you are using a diamond or homemade
pick), and reinsert it to work the bottom wafers. You may
have to repeat this process a few times, but double-wafer
locks can and will open with such treatment. Schlage has
a doorknob lock that opens this way, but the last tumbler
is about one and one-half inches in.

Double-wafer locks are easy to master if you have
learned to pick pin and wafer tumbler locks. Since double-
wafer locks are more compact, you have to compensate
for the fact-slightly closer tolerances. These type of locks
are used on old pop and candy machines, gas caps,
cabinets, etc.


PIN AND WAFER TUMBLER PADLOCKS


Cylinder padlocks require a technique of holding them
with the same hand with which you are using the tension
wrench. This technique allows one to pick the padlock
without going into contortions over a dangling padlock.
Assuming that you are right-handed, hold the padlock
in your left hand by gripping the body of the padlock with
your thumb and forefinger. Insert the tension wrench at
the bottom of the keyway and hold it in a clockwise turn
with your ring and little finger, causing a slight binding
pressure on the cylinder. Now your right hand is free to
pick, and your left hand does the job of holding both the
lock and tension wrench. The overhand method works
well, too, but the thumb controls the tension wrench
instead. Switch around to find which is most comfortable
for you.

When tumbler padlocks pop open, it is quite a sensa-
tion because the shackle is spring-loaded and gives one
quite a jolt. It's a feeling of accomplishment. You may
need a little more tension on padlocks than on door locks
because the cylinder cam has to operate a spring-loaded
bolt. Overall, padlocks are the most fun to open. Prac-
tice using old or discarded padlocks that you have found.
I've worn out hundreds of them.



TUBULAR CYLINDER LOCKS

(Note: Diagrams of tubular lock were omitted due to the fact that picking
them with conventional methods is a complete waste of time. There are picks
available that are specifically designed to pick this kind of lock in a
matter of seconds)


We will gradually proceed to more sophisticated locks
from here. I would like to remind you that success is not
based on personality. If one is arrogant about one's lock-
picking skills, one could easily be made a fool of by a
lock. And no matter how many times you bash a cylinder,
you will still be locked out. The only thing you accomplish
is attracting an audience-so be cool.

If at this point you have had much difficulty under-
standing the principles of pin and wafer locks, please
restudy this book from the beginning. Read it several times
so as to absorb it. The information that you now have
has taken me almost two decades to gather, so please be
mindful of that.

Now you are about to learn how to open the more dif-
ficult locking mechanisms-some of the other 25 percent
of the locks used today. You should feel confident with
pin, wafer and double-wafer tumbler locks before you
attempt rim cylinder locks.

Tubular cylinder locks stand out as the most generally
accepted lock in all important industries using high-quality
locks for protection of property, merchandise, and cash.
They are recognized as giving the maximum amount of
security for their price range.

Tubular cylinder locks are pin tumbler locks arranged
on a circular plane. Unlike conventional pin tumbler locks,
all of the pins are exposed to the eye. The central section
of the lock rotates to operate the cam when all of the seven
pins have reached their breaking points. When the pro-
per key is entered into the lock, the tumblers are pressed
into position so that the central section (plug) can be
turned. This manual operation of inserting the key places
the tumblers in position so that the lock can be operated
and ensures that frost, dust, salt, or unfavorable climatic
conditions will not affect the smooth operation of the
lock.

The Chicago Ace lock is a product of the Chicago Lock
Company of Chicago, Illinois. It is an effective security
device and is used on vending machines, coin boxes, and
burglar alarms. A larger, more complex version of it is
used on bank doors and electronic teller machines. The
key is of tubular shape with the cuts arranged in a circle
around the key.

The pick used for this lock is the tubular cylinder pick,
or you may use a straight pin or your homemade safety
pin pick. The one-pronged end of the tension wrench is
a little more specialized and is used for rim cylinder locks.
It must be .062 inches square for best results. Any square
steel stock is acceptable, as long as it fits snugly into the
groove of the tubular cylinder plug.

This type of lock is a burglar's nightmare because it
takes so long to pick. You have to pick it three or four
times to accomplish the unlocking radius of 120 to 180
degrees. And the cylinder locks after each time you pick
it-every one-seventh of a turn.

If you leave the lock only partly picked, the key will
not be able to open it, so you must pick it back into the
locked position after opening it-another three or four
picking sessions. In all, to unlock and lock the cylinder,
you have to pick it up to eight times-quite a chore if you
don't have the right tools or time.

These locks almost always pick in the clockwise direc-
tion. Make certain that the tension wrench fits snugly into
the groove on the cylinder. Very slowly push the first pin
down until it clicks, maintaining a definite clockwise
pressure on the tension wrench. Once the tumbler has
broken, do not push any further and proceed to the next
one, and so on. As you reach the last tumbler, the ten-
sion wrench will feel more slack and give way if the lock
were properly picked.

There are special keyhole saws for these locks in which
you drill out the tumblers and turn the cylinder. Also there
is a special tool used by locksmiths to open rim cylinder
locks.


MUSHROOM AND SPOOL PIN TUMBLER LOCKS


High-security pin tumbler locks may contain specially
made pins to make picking them more challenging. The
pins are machined so as to make picking them quite dif-
ficult. When picking these locks, the pins give the impres-
sion that they have broken, when in fact they could be
a long way from breaking. You can tell whether or not
you are picking a pin tumbler lock that has these pins by
the fact that the pins seem to align so easily with a louder
than normal click. The cylinder seems eager to open but
to no avail.

The picking procedure relies on a well-yielding tension
wrench. The tension wrench has to be lightly spring-loaded
so that the pins can bypass their false breaking points.
You also have to "rake" (seesaw in and out) the pins with
your pick. The feather-touch tension wrench is ideal for
the job. Use light pressure with it, and it will let you in.

(Note: A feather-touch tension wrench is not necessarily required. A normal
tension wrench will work fine with an extremely light tension on it. The
weight of just your index finger alone should be enough in most cases.)

The mushroom and spool pins are used in locks for
high-security purposes such as bank doors. The American
Lock Company uses them in some of their padlocks.



MAGNETIC LOCKS



Magnetic locks are fascinating. I almost hate to open
them because I feel that I have breached their uniqueness.
In reality, you do not pick them, but "confuse" them. They
generally work on the principle that like magnetic
polarities repel each other. The key is a set of small
magnets arranged in a certain order to repel other magnets
in the lock, thereby allowing the spring-loaded bolt or cam
to open the lock.

By using a pulsating electromagnetic field, you can
cause the magnets in the lock to vibrate violently at thirty
vibrations per second, thereby allowing it to be opened
by intermittent tugging of the bolt or turning of the door
knob.

This method may also ruin the small magnets in the
lock by changing their magnetic status or properties. So,
if you have to perform an emergency break-in with these
locks, do not relock the door. The card or key will not
operate the lock.

The magnetic pick can be used on padlocks by strok-
ing it across the place where the key is placed. It is also
designed to fit into the doorknob and is used by stroking
one pole in and out or by using the other pole the same
way.

If you have had little or no training and experience
building something like this, please have a friend who is
familiar with basic electronics do it for you. Do not take
the chance of electrocuting yourself. Make sure that the
coil is also completely covered with electrician's tape after
you have wound the 34 gauge wire. Also make sure that
the steel core has at least three layers of tape over it. Do
not leave the unit plugged in for more than two to three
minutes at any one time as this may cause overheating
which could cause it to burn out or start a fire. It is safe
to use if constructed properly and not left plugged in
unattended. Opening magnetic locks requires only 30 to
60 seconds anyway, so don't leave the unit plugged in for
longer.

For magnetic padlocks, use a back-and-forth stroking
action along the length of the keyway. For magnetic door
locks, use a stroking in-and-out action in the slot of the
knob alternating from one side (pole) of the pick to the
other.

The "key" for a magnetic door lock is a metal or plastic
card containing an array of magnetic domains or regions
coded in a specific order to allow entry. The magnetic pick
bypasses that.


(See fig-08.GIF)


DISK TUMBLER LOCKS


Combination or "puzzle" locks were invented to fur-
ther improve security and the protection of valuables. The
older safes and lockboxes were good security devices when
they came into the market, but some people became
curious and realized that these safe locks had inherent
weaknesses. One of the main problems was that the disk
tumblers were not mechanically isolated from the bolt that
unlocks the safe door. In other words, you could feel and
hear the tumblers while turning the dial by applying
pressure on the handle of the bolt.

When that problem was recognized and solved, thieves
started drilling through strategic places in the lock itself
to open it. Knocking off hinges was an all-time favorite
tactic as well. Then came punching out the dial shaft,
blowtorching, and just plain blowing the door with ex-
plosives. Greed can breed great creativity.

The first problem, that of manipulating the tumblers
open, was rectified by making use of the dial to operate
the bolt upon completion of the dialing of the correct com-
bination. This made it nearly impossible to feel or hear
the tumblers. Drilling was deterred by laminating the safe
door with hard steel and beryllium-copper plates. The
beryllium-copper plates pull heat away from the drill tip
quickly, and the bit just spins without effect; drilling can-
not take place without the generation of heat at the bit's
cutting edges. Knocking off hinges was discouraged by
using three or more bolts operated by a main linkage net-
work. Punching out the dial shaft to let the tumblers fall
out of the way of the bolt was corrected by beveling the
shaft into the wall of the safe door.

Presently, safe locks are quite sophisticated. Picking
them would require supernatural power. The older safes,
however, are much easier and even fun to pick. Picking
combination padlocks is a good way to start learning how
to open safes, and we will get to them shortly. But first,
let us discuss some basic prmciples of disk tumbler locks.

Disk tumbler locks work by the use of flat, round disks
of metal or plastic with a notch and a peg on each disk.
The notch is called the tumbler gate. The gate of each
tumbler has to be lined up with the pawl of the bolt
mechanism by usage of the linking capabilities of the pegs.

The first tumbler of the disk tumbler lock (also the last
combination number dialed) is mechanically connected
to the dial through the safe door. When the dial is turned,
the first tumbler picks up the middle tumbler when their
pegs connect. The middle tumbler in turn picks up the
last tumbler for one more complete turn and the tumblers
have been "cleared"-you are ready to dial the first com-
bination number by aligning the last tumbler's gate to the
pawl. After you have reached this number or position,
rotate the dial in the opposite direction one complete turn
(for three tumbler locks; two turns for four tumbler locks)
to engage the middle tumbler and drive it to the second
combination mlmber. By rotating the dial back into the
opposite direction to the last combination number, the
bolt can be operated to open the lock, or as in the case
of newer safes, the dial will operate the bolt by turning
it once again in the opposite direction.

One of the innovations that developed to deter sensual
manipulation of combination locks was the use of ser-
rated front tumblers (last combination number dialed).
These were designed to foil listening and feeling of the
tumblers' gates by burglars.

When the bolt encountered any one of these shallow
gates, the safecracker could never be sure whether or not
a tumbler was actually aligned with the pawl-bolt
mechanism. Some burglars solved this problem by attach-
ing high-speed drills to the dial knob to rotate and wear
down the first tumbler's shallow false gates against the
bolt, thereby eliminating them altogether, or at least
minimizing their effects. Still, today the serrated tumbler
is used as an effective deterrent to manipulation in com-
bination padlocks where space is a factor.

Let us move on to combination padlocks. The most
common and difficult to open of these small disk tumbler
locks are the Master combination padlocks, and they are
quite popular. I have had good luck in opening these locks
with a wooden mallet or soft-faced hammer. The manip-
ulation of Master combination padlocks is quite easy-I
have done it thousands of times, and you can learn it, too.
The newer the lock is, though, the more difficult it will
be to open at first. If the lock has had a lot of use, such
as that on a locker-room door where the shackle gets
pulled down and encounters the tumblers while the com-
bination is being dialed, the serrated front tumblers will
become smoothed down, allowing easier sensing of the
tumblers. So, until you have become good at opening these
locks, practice extensively on an old one. Let's try to open
one:

OPENING A COMBINATION PADLOCK

STEP ONE

First, clear the tumblers by engaging all of them. This
is done by turning the dial clockwise (sometimes these
locks open more easily starting in the opposite direction)
three to four times. Now bring your ear close to the lock
and gently press the bottom back edge to the bony area
just forward of your ear canal opening so that vibrations
can be heard and felt. Slowly turn the dial in the opposite
direction. As you turn, you will hear a very light click as
each tumbler is picked up by the previous tumbler. This
is the sound of the pickup pegs on each disk as they engage
each other. Clear the tumblers again in a clockwise man-
ner and proceed to step two.

STEP TWO

After you have cleared the tumblers, apply an upward
pressure on the shackle of the padlock. Keeping your ear
on the lock, try to hear the tumblers as they rub across
the pawl; keep the dial rotating in a clockwise direction.

You will hear two types of clicks, each with a subtle
difference in pitch. The shallow, higher pitched clicks are
the sound of the false gates on the first disk tumbler. Do
not let them fool you-the real gates sound hollow and
empty, almost nonexistent.

When you feel a greater than normal relief in the shackle
once every full turn, this is the gate of the first tumbler
(last number dialed). This tumbler is connected directly
to the dial as mentioned earlier. Ignore that sound for now.
When you have aligned the other two tumblers, the last
tumbler's sound will be drowned out by the sound of the
shackle popping open.

STEP THREE

While continuing in a clockwise direction with the dial,
listen carefully for the slight hollow sound of either one
of the first two tumblers. Note on the dial face where these
sounds are by either memorizing them or writing them
down. Make certain that you do not take note of the driv-
ing tumbler (last number dialed). If you hear and feel only
one hollow click (sounds like "dumpf"), chances are that
the first number could be the same as the last one.

You should have two numbers now. Let us say one of
them is 12 and the other is 26. Clear the tumblers again
just to be safe and stop at the number 12. Go
counterclockwise one complete turn from 12. Continue
until there is another "dumpf" sound. After the complete
turn pass 12, if you feel and hear a louder than normal
sound of a tumbler rubbing on the pawl, the first tumbler
is properly aligned and the second tumbler is taking the
brunt of the force from the shackle-you are on the right
track. When the second tumbler has aligned in this case,
you will feel a definite resistance with the last turn of the
dial going clockwise. The final turn will automatically
open the shackle of the lock. If none of these symptoms
are evident, try starting with the number of the combina-
tion, 26, in the same way.

STEP FOUR

If the lock still does not open, don't give up. Try search-
ing for a different first number. Give it a good thirty- or
forty-minute try. If you play with it long enough, it will
eventually open. The more practice you have under your
belt, the quicker you will be able to open these padlocks
in the future.

Using a stethoscope to increase audibility of the clicks
is not out of the question when working on disk tumbler
locks, though I never use them for padlocks. A miniature
wide-audio-range electronic stethoscope with a magnetic
base for coupling a piezoelectric-type microphone is ideal
for getting to know the tumblers better.

Filing your fingertips to increase sensitivity might not
be such a good idea for beginners since their fingertips
will not be accustomed to operating dials for a long period
of time. With practice, you may develop calluses and need
to file your fingertips. But I don't recommend it at first.

After some time you may find that in some cases you
can whiz right through the combination of an unknown
lock without looking at it and pop it open in seconds.
It becomes second nature. I've done this on many occa-
sions-something beyond my conscious control seems to
line up the tumblers without my thinking about it.

Another type of disk tumbler padlock is the Sesame
lock made by the Corbin Lock Co. Its unique design
makes it more difficult to open than Master padlocks, but
it can be opened. Let's take one of the three or four wheel
mechanisms, look at a cross section, and see how it works.
The wheel has numbers from zero to nine. Attached to
the wheel is a small cam. Both the wheel and cam turn
on the shaft. Each wheel in this lock operates indepen-
dently with its own cam and shaft. The locking dog is
locked to the shackle. In this position the shackle cannot
be opened. The locking dog operates with all three or four
wheels. The locking dog is riding on the round edge of
the cam. The spring is pushing up on the cam. The lock-
ing dog cannot move up because it is resting on the round
part of the cam. When the wheel is turned to the proper
combination number, the locking dog rests on the flat of
the cam. The spring can then raise the locking dog to
release the shackle, and this opens the lock.



TIPS FOR SUCCESS


You will undoubtedly encounter a pin tumbler lock in
which there will be a pin or two that is keyed too low
(the shear line of the pin is too high). In this case the lock
is difficult to open because the breaking point of a long
bottom pin doesn't allow room in the keyway for the pick
to manipulate the other pins. Your success in opening
"tight" locks will depend on the skill you have developed
with your tension wrench. Sometimes it helps to play with
the tension wrench. Try bouncing it left and right slightly
while picking, allowing some of the tumblers to drop occa-
sionally. You may also try picking the front tumblers first
or picking at random on these locks. You can tell if you
have a lock that is keyed like this because your pick may
get jammed during the picking process.

After you have opened a cylinder and unlocked a lock,
be sure to return it to the locked position. You will hear
the tumblers click into place when this happens. Other-
wise it may be difficult to unlock it with its key because
the bottom pins cannot "float" like they normally would.

To tell whether or not the cylinder should go clockwise
or counterclockwise when picking a tumbler lock, there
is an easy rule to follow. If the tumblers (pin or wafer)
will not break, or stay broken, you are going in the wrong
direction with the tension wrench. There will be little or
no progress with the cylinder, and few, if any, "clicks."

Some keyways are cut at an angle (Yale, Dexter, and
Schlage, for example) so you want to be sure that you tilt
your pick to follow that angle while picking or your pick
will get hung up. A slight twist of the wrist will compen-
sate for this problem.

Should your fingers become tired while picking a lock,
lay down your tools and shake your hands and fingers
to relieve any tension. After some time the muscles in your
hands will become accustomed to such activity. Practice
and persistence will tone your hands and senses to the
point where you will be able to pop open a cylinder in
three to five seconds (that's seconds) in total darkness. The
combination of touch and sound lets you know almost
a split second before you open the lock that you have
succeeded.

If the lock is a well-machined one, the cylinder will feel
tight and you will need a little firmer hand on the ten-
sion wrench. While picking, if any one of the pins at any
time feels firm or difficult to move, chances are it's aligned.
If it feels springy, it is not.

Use the shaft of the pick if you have to when working
the frontal pin of a pin tumbler lock. This may save you
the trouble of aligning the tip of the pick on the front
pin where there is little or no support for the pick. All
of the other pins allow the pick to be supported by the
inside wall of the keyway.

Master keyed pin tumbler locks are generally easier to
pick open because they have more than one shear line or
breaking point in the pins. Master keying allows a group
of locks to be controlled by a master key holder while the
individual locks in that group are controlled by individual
keys. Hotels and apartment complexes are usually master
keyed.

There is a simple technique to open pin and wafer
tumbler locks. Simply drill through the shear lines of the
tumblers. This point is located just above the center of
the keyway on the face of the cylinder. By doing this,
though, you obviously ruin the lock and make a lot of
racket. If the lock is a Medeco or some other high-security -
lock, you risk damage of one hundred dollars or more,
so be sure you know the value of the situation before you
decide to rape the lock. Use a center punch to start a
reliable hole on the cylinder face and use a one-quarter
inch drill bit with a variable speed drill. With a large
screwdriver, turn it to unlock. The cylinder will be dif-
ficult to turn because you may be shearing the tumbler
springs that have fallen down past the cylinder's shear line.

Dead bolt locks are those mounted on a door above
the knob. All dead bolt locks unlock counterclockwise
with left-hand doors and clockwise with righthand doors.
If you have trouble remembering this, just remember that
the bolt of the lock has to go in the opposite direction
of the doorjam.

Dead bolt locks are just as easy to pick open as knob
locks are. They both have cylinders that can be picked
open. The main difference is that dead bolts cannot be
opened by sliding a plastic or metal card through to the
bolt so as to work it back. In other words, they are not
spring loaded. That's why they are called dead bolts. Most
knob locks now have guards in front of the bolts to deter
opening with cards.

Kwik-sets, Weisers, and some of the less-expensive knob
locks may open in either direction. Schlage and Corbin,
along with more sophisticated locks, can open only in one
direction. Auto locks will open either way. Another
method of picking pin tumbler locks is with a pick gun.
As the pick snaps up, it hits the bottom pin. This bounces
the top pin out of the cylinder and into the shell. As you
apply light turning pressure with the tension wrench, the
top pins are caught in the shell, the cylinder will turn. I've
never used a pick gun, but they do work well for lock-
smiths who use them. They are cumbersome and expen-
sive, and show some lack of professionalism.

(Note: If you don't care about professionalism and want to open 95% of all
pin tumbler locks out there - and fast- buy this device. It is very awesome.
I even recommend it over a Cobra Electronic lockpick. Trust me, I have both,
and I feel the $60 Lockaid pick gun blows away the $350 Cobra)


SOME PRECAUTIONS

If you bought this book to learn how to pick locks in
order to become a more efficient burglar, then there is
not a whole lot I can say or do to stop you. But I must
say this: the locks used in prisons are nearly impossible
to pick even if you get or make the right tools. They are
usually electrically controlled from an external station.

Do not carry lock picks on your person. If you get
caught with them, you could get nailed for most any pro-
fessional job in town for the last seven years. If you must
carry them, as in the case of rescue workers, etc., please
consult your local authorities about details and ask about
registering with them. As a former locksmith, I do not
have that problem.

I advise that you do not teach your friends how to pick
locks. The choice is yours, of course. You paid the price
of this book and the knowledge is yours-be selfish with
it. It is for your own protection as well. The fewer people
who know you have this skill, the better. Getting blamed
for something you didn't do is unfair and a hassle.

When you become proficient at picking locks, you may
decide to get a job as a locksmith. But believe me, there
is more to being a locksmith than being able to pick locks.
You have to be a good carpenter as well as a fair mechanic.
But you may want to approach the owner of a lock shop
and ask if you could get on as an apprentice.

NOBODY'S PERFECT

There isn't a locking device on earth that cannot be
opened with means other than its key or code. It's just
that some are easier to open than others. Anything with
a keyhole, dial, or access port is subject to being opened
with alternate means, though some of the newer electronic
and computer-controlled security devices would be a
nightmare even if you had extensive knowledge of elec-
tronics and electromagnetics. Some devices also use palm
prints as a readout to allow entry.

On the mechanical side, there are locks that have nor-
mal pin tumblers, but they are situated in various places
360 degrees around the cylinder. Some locks use pin
tumblers that not only have to be aligned vertically within
the cylinder, but also have to "twist" or turn a certain
number of degrees to allow the cylinder to open. This is
because the pins' shear line is cut at an angle. These locks
are made by Medeco.

I have witnessed only one Medeco lock being picked-
by a fellow locksmith. We both spent hours trying to pick
it again, but it was futile. We estimated the chances of
opening it again to be one out of 10,000. They are excellent
security devices, but their price keeps them limited to areas
prone to security problems such as isolated vending
machines and for government use. The only one I have
been successful at opening (after an hour of picking) was
one I drilled. By the way, they are easy to drill because
the brass that's used is soft.

LEARNING TO TOUCH AND FEEL

Most of us know how to touch. We touch objects every
day, and yet we do not truly feel them. It seems so
commonplace that we forget that we are actually feeling
while we touch.

Here is an exercise that will develop a delicate touch.
Gently rub and massage your hands and fingers-
preferably with hand lotion. Do this for five minutes. Once
the lotion has evaporated, shake your hands and fingers
so that they flop loosely. Gently pull each finger to relax
each joint.

Now with a piece of fine sandpaper, gently draw the
tips of your fingers across it. Try to feel the texture of
the grains on its surface. Relax your fingers, hands, fore-
arms, shoulders, and chest. Take your time. Do this for
several minutes.

After a few weeks of practice, you will be able to feel
each individual grain of sand on the sandpaper. This
allows you to feel the slightest sensation vibrate through
your bones.

Try to remember to practice touching and feeling dur-
ing your everyday experiences. Practice feeling wood,
metal, and various other objects. Play with the feel of
mechanical vibrations, even your television set. Try to sense
the world around you as a source of information. This
could and will open a whole new horizon of experience.

After a while, you will be able to feel or sense the move-
ment of the tumblers of a Sargeant and Greenleaf safe.
My first safe opened in three minutes because of that
technique that took me years to discover.

VISUALIZATION

If you respect the security of the lock and do not
become overconfident, you will never become disappointed
if you fail to open it. You also increase your chances of
opening the lock because you personally have nothing to
gain or lose by opening it. Give up trying to be an expert
and just pick the lock.

With such an attitude, you may find the lock will usually
pop right open. I never received a trophy for being the
best lock picker in the state. My satisfaction is in know-
ing that I am never helpless in a lockout situation. The
quality of your success is almost romantic; it involves sen-
sitivity and compassion in the face of curiosity as a means
to help others.

Visualization and imagination are important to the lock
picker. I've noticed that people who have the ability to
visualize the internal parts of the lock that they are pick-
ing seldom fail to open it in moments. Anyone can learn
to do this by simply remembering to do it while picking
a lock. Since sight, sound, and touch are involved with
the process, visualization is very easy to do. Try to keep
all of your attention on the lock during the picking pro-
cess. This will help you to learn how to use heightened
sensitivity for picking locks.

So in that respect, an unopened lock is like a new and
unexplored lover. You imagine all of the qualities of an
attractive person whom you've just met and apply that
feeling to the lock that you are picking. Use visualization.
It will help immensely.

Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader

REVERSE CODING

Sunday, May 25, 2008 with 4 comments »
Add to Technorati Favorites

=========================================
----------------------
REVERSE CODING
----------------------


# Released by Cybnet Security Group
# legalz: modify and use at will, if you make any changes, improvements, updates or use the code
# in another project, please send us what you did and give credit
# if you have any questions, post them at forum.hackerthreads.net
# be sure to check out hackerthreads.org for updates and new tutorials/downloads

Copyrights reserved to k33t, 2002 from CYBNET Security Group
----------------------------------------------------------------------------------------------------

Index:
-------
1.Introduction
2.Disclaimer
3.Hexadecimal
4.RAM and ROM
5.ASM
6.Needed programs
7.Cracking
8.Conclusion
---------------------------
---Introduction----------

Welcome to my Reverse Coding tutorial! In this paper, you will
learn how to crack and modify your own software. I'll try to get
into as much detail as possible, yet also dumb it down a bit. =)
------------------------------------------------------------------------------------------------------
---Disclaimer------------

All information is purely for educational purposes only! The author
cannot be held responsible for any (ab)use of this information.
USE AT YOUR OWN RISK!!!
------------------------------------------------------------------------------------------------------
---Hexadecimal----------

To begin, I'm going to teach you about hexadecimal, so if you already
know it, then move on. Even if you do already know it, I suggest
sticking around for a refreshment of your memory.=)

Hexadecimal, or hex as it's more commonly known, is a base 16
numbering system. Base 16 meaning that it consists of 16 numbers:
0-9 and A-F. Each of these numbers (A-F=10-16) have a value of 4 bits
and are also called nibbles. In representing a hexadecimal number, one
would write an "0x" before the actual bit set. 0x is simply a tag put
before a hex number to let programmers know that it is in fact, hex.
When writing hex, you will not need to use this prefix.

If you haven't already noticed, the 0x prefix looks similar to that of exponential
notation. Actually this is where 0x has been derived, seeing as how
hex is simply a number that has been raised to a power of 16.
This means 10 in hexadecimal represents the value 16+0, or 16. So check
out this example:

0xB3 (hex)= 2*16(squared)+11*16(to the 1st power)+3*16(to the power of 0 )
=2*256+11*16+3=691 (decimal)

Yeah, you could do all of that, or you could be lazy and use an automated
program that does it all for you. Why do you need to know hex? Because
it's used by every piece of software and hardware. How? Memory based address
allocation. Here's an example:

When you clicked on your browsers icon to launch it, the click triggered a "call"
(an asm function that will be discussed more in depth in later chapters.) which
went back to the programs memory with the "click in it's hand." It finds the
address where the code is that makes the program launch and executes it. The
address is written in, you guessed it, hex. An example of an address would be
something like this:

101c5018

5108 would be the actual specific address and 101c would be the sector
of RAM were the address is located. Those are the basics of Hexadecimal
You should probley read this chapter againbecause getting a firm grasp on hex
is essential to cracking and moding programs.
----------------------------------------------------------------------------------------------------------
---RAM and ROM--------

In this section we are gonna learn about RAM and ROM. Many people kno about
the hardware part of RAM and ROM and that's gonna be very useful to you......
just not in this tutorial. =) We are about to learn about the "software" side. I use the
term software loosly in that software tends to have a GUI (Graphical User Interface)
and this does not. BUT, there are ways to access and modify the behavior of it that
I will talk about in this chapter, as well as in the next. To start off, I'll answer some
common questions:

What is RAM?

RAM (Random Access Memory) is basically memory and the process of accessing it.
The term "Random Access Memory" was approprietly given to this memory unit because
when executing a command, the CPU doesn't have to scroll through all the memory on
your PC until it finds the right address. It "randomly" whips out the addy from it's back
pocket and serves it up.This process is both quick and efficient. Learning this process
will help you understand the ASM functions in the next chapter.

How does RAM work?

When a command is issued and the memory is pulled from file, it must first go through
what is called a "vector". A vector is a "gateway" or a "sector" of RAM where the address
of the function is stored with others of it's own kind. An example of a vector would be
something like this:

8c0000b4-8c00ffff

This means that all "addressii" (hehe) that are between those values are stored in that
sector of RAM. A vector acts as a gateway in that, first, pass through a vector to get to
address. Your average program probley has about 30 to 40 main vectors, sectioning
off from boot until exit. Knowing the vector of an addy or a function will greatly reduce
your headache when you start searching for it.

ROM. ROM is a part of memory that doesn't change. (Although we can change it.=) )
Boot ROM for instance, follows the same plan of action it is called upon. ROM also has
vectors, just like RAM. ROM is not that important when it comes to cracking to we will
leave it alone for now.

Back to RAM. Believe it or not, but addressii (there I go again, I'm such a g33k.)
actually follow certain formats or syntax's for certain functions. Take hot keys for
example: In the under ground, we call them "Joker commands". By pressing a certain
combonation of keys, a program will run, close, be stupid, whatever. The syntax for a
Joker command is as follows:

0d-aaaaaf
000zvvvv

Let's examine this format a little closer.

0d= The proclemation of a specifyed format

aaaaa= The address of the function

f= The float or remainder; "Floating point number" ; decimal

000= "NOP" No operation

z= The "Booleon" as we the C++ programmers call it. A booleon is an "IF, THEN" statement.
"IF this is true, THEN do this." Value 0= equal; 1= different; 2=less than; 3=greater than.

vvvv= The combonation of hex values (The values of the keys pressed) used to execute the "CALL"

Say the "A" key had a vlaue of fffb and the "B" key has a vlaue of fffd. You would then add both
values using a hex calculator and get fff9 as the sum. The output on you calculator would
show 1fff8. Add the first value and the last value to find the fourth byte segment. So say
we've found the address of the Joker function (usually in the boot ROM sector) commonly
called the "Maple address" and we are ready to program in some hex code. Our code may
look like this:

0d7ae671
0000fff9

This means that IF the value of fff9 (A and B) is equal (0) to the address (aaaaf) of the function,
THEN execute it. See? Easy isn't it? You'll need to know things like this when modding programs
as a use of executing of your arbitrary code in certain parts of your program at a certain time.
Joker commands are also reversable in that if you enter the same code except with a 1,2, or 3,
in the z slot and by changing the button combonations. Reversable meaning terminating the
function or other functions that were started. A good use for this is for firewalls and babysitting
programs. Are you on a college machine and can't download stuff because of that pesky firewall?
Crack it open and program in some Joker commands so you can turn it on and off at will
WITHOUT the administrator's password!
--------------------------------------------------------------------------------------------------------------
---ASM-----------------------

To start off with our small and to the point ASM section, I'll warn you in advance, after reading this,
you'll need to go take a shower cause this is disgusting! Here we go!

To begin, I'm gonna define for you some functions that you'll be seeing alot of, and be using. Here they are:

.:Hex:. .:ASM:. .:MEANING:.

75,0f85 jne jump if not equal
74,0f84 je jump is equal
eb jmp jump directly to
90 nop no operation
77,0f87 ja jump if above
0f86 jna jump if not above
0f83 jae jump if above or equal to
0f82 jnae jump if not above or equal
0f82 jb jump if below
0f83 jnb jump is not below
of86 jbe jump if below or equal
0f87 jnbe jump if not below or equal
0f8f jg jump if greater
0f8e jng jump if not greater
0f8d jge jump if greater or equal
0f8c jnge jump if not greater or equal
0f8c jl jump if less
0f8d jnl jump if not less
0f8e jle jump if less or equal
0f8f jnle jump if not less or equal

The easy thing about most of the functions in ASM are that they sound like what they mean.
Jump, means of coarse, to Jump from one thing to another. Example:

"jmp 00401744" would mean to jump directly to the address 00401744 once the code
hits the function.

Let's look at "CALL". Call is a function that is used to "call" a certain task, string, address, whatever.
Take a look at this example:

"Call 0040ccc2" this would of coarse call the address 0040ccc2 and use it. Those are the functions
you'll be using.

The reason why I'm not going into loads of detail in this chapter is because when
cracking software, not an extensive amount of knowledge of ASM is needed. If you want
to know more or need help with something, e-mail me at the address provided at the end of
this tutorial. This chapter wasn't so nasty was it? Nah, it was easy =)
------------------------------------------------------------------------------------------------------------------------
---Needed Programs----------------

The programs you will need are as follows:

WDasm 8.9 or Higher
Hiew 6.1
Softice for win9x v3.24
SubmitWolf(demo)v4.01 (http://www.trellian.com/swolf)
Programming Language (C,C++,Pascal,ASM whatever you would like) Prefably C for this tutorial!
And a brain (no seriously)
--------------------------------------------------------------------------------------------------------------------------
---Cracking-----------------------------


Ok, here we go! The first thing you need to do is to open up SoftIce and then swolf32.exe which is the name given to our
target program. Go to the help menu and select register. Here's where your brain will come in, start to look
for how the protection is running by entering some random crap into the blank space. Don't press the OK button yet though.
Instead, press CTRL-D to bring up SoftIce. What we are gonna try to do is define a breakpoint, using BPX hmemcpy.
Hit CTRL-D again and it will bring you back to the program. Click OK on the box and SoftIce will again pop up. Now press F12
and it will bring you to the target program code. Scroll down a few lines and find:

:004167D9 8D4C2410 lea ecx, dword ptr {esp+10}--;ecx=the random crap you typed in.
:004167DD 8D94290000000 lea edx, dword ptr {esp+00000090}-;edx=name
:004167E4 51 push ecx
:004167E5 52 push edx
:004167E6 E8B5450100 call 0042ADA0----;this is the call which calculates the serial
:004167EB 83C410 add esp, 00000010--;
:004167EE 85C0 test eax, eax----;and return eax=1 if true (booleon =) )
:004167F0 0F8596000000 jne 0041688C----;jump to registered
:004167F6 8D442408 lea eax, dword ptr {esp+08}
:004167FA 8D8C2488000000 lea ecx, dword ptr {esp+00000088}
:00416801 50 push eax
:00416802 51 push ecx
:00416803 E868470100 call 0042AF70----;this call tests our serial
:00416808 83C408 add esp, 00000008---;
:0041680B 85C0 test eax, eax----;for v3.XX one.
:0041680D 7433 je 00416842;jump is equal

The call that we want to focas on is at 004167E6. This call tests wether our serial is for the correct version or not.
Let's trace the call 004ADA0:

*Referenced by a CALL at address:
:0042ABFC
:0042ADA 83EC30 sub esp, 00000030
:0042ADA3 55 push ebp
:0042ASA4 56 push esi
:004ADA5 57 push edi
:0042ADA6 8B7C24444 mov edi, dword ptr {esp+44}--;edi=our fake serial
:004ADAA 85FF test edi, edi
:004ADAC 0F4A7010000 je 0042AF59----;die if empty
:004ADB2 8B6C2440 mov ebp, dword ptr {esp+40}--ebp=our name
:0042ADB6 85ED test ebp, ebp
:004ADB8 0F849B010000 je 0042AF59---;die if empty
:004ADBE 8A07 mov al, byte ptr {edi}--;compare 1st byte of serial with 'p', die
:0042ADC0 3C50 cmp al, 50----;
:0042ADC2 0F8587010000 jne 0042AF4F----;if not equal
:0042ADC8 807F0134 cmp byte ptr {edi+01}, 34--:compare byte of serial with '4'
:004ADCC 750C jne 0042ADDA----;
:0042ADCE C70500C8430000000000 mov dword ptr {0043C800}, 00000000
:0042ADD8 EB1C jmp 0042ADF6

As we can see by the above, the code tells us that the first value of our serial will
be 'p' and a cycle of a four byte algorythm. I could go on and on about all of the internals
of all this stuff but that would be going beyond the scope of this tutorial. The idea was to show
how to crack this pro, and thats what I'm going to do. Based on the information I've given you, and the
information that you can deduce from reading the code, I've written a small key generator in C.
If you know C, then you'll be able to tell where i got the algorythms to write it. So here it is:

#include
#include

int main(void)
{
long code=555583,count1,count2;
char name[25],cod[5],type='0';
clrscr();
textcolor(14);
printf("This is a simple key-generator written by k33t of CYBNET Security Group");
printf("=================================================");
text color(10);
printf("SubmitWolf(demo)ver4.1 cracked by k33t");
textcolor(14);
printf("%c%c%c",0x10,0x10,0x10");
textcolor(12);
printf("Yup")
prinf("-November 2002");
prinf("'\n\nSelect Edition PRO(0) or Enterprise(1) (0/1)=");
scanf("%c",&type);
if(type=='1')code=557283;
getchar();
prinf("Enter Registration Name=");
scanf("%[^\n]",name);
for(count1=0;count1<=3;count1++ cod[count1]=name[count1]; for(count=1;count1=3;count1++){ for(count2=0;count2<=3;count2++) cod[count2]=cod[count2]*(code%100); code=code/100; } for(count1=0;name[count1]>0;count1++);
for(count2=0;count2<=3;count2++) cod[count2]=cod[count2]^(name[count1]+3); for=(count1-3;count1>=0;count1--){
code=code+(cod[count1]&0xFF);
if(count1>0)
code=code*0x100;
}
if(code<0)code=-code; code="code*10;">999999;) code=code/10;
printf(Your Serial Number=P%c4-%ld",(type=='1')? 'E':'4'code);
return ;
}

Ok! So! An overall conclusion of this code is:

1.First two characters of the serial must be either 'PE' or 'P4'.
2.Multiply every first four characters or our name with every byte of our serial before '-'
3.XOR every four byte with every byte of our name.
4.Convert to positive number if<0.
5.Convert to number between 10000 and 1000000.

Forgive me if this code is buggy as I wrote it very quickly in the little spare time I had.

-----------------------------------------------------------------------------------------------------------
---Conclusion-------

Well how was your first cracking expierience? Not bad eh? Ok well if you have any questions,
problems,comments,.....criticsms.......you can e-mail them to me at:

k33t@hushmail.com
------------------------------

Add to My AOL Add to Google Reader or Homepage Add to netomat Hub I heart FeedBurner Subscribe in NewsGator Online Subscribe in a reader