;-------------------------------------------------------------------------------
;				MODEL INFO
;-------------------------------------------------------------------------------
	.486
	.mmx
	.model flat ,stdcall
	option casemap:none

;-------------------------------------------------------------------------------
;				INCLUDES
;-------------------------------------------------------------------------------

	include windows.inc

	include user32.inc
	include kernel32.inc
	include comctl32.inc
	include comdlg32.inc
	include shell32.inc
	include advapi32.inc
	include gdi32.inc
	include imagehlp.inc

	includelib imagehlp.lib
	includelib gdi32.lib
	includelib comctl32.lib
	includelib comdlg32.lib
	includelib shell32.lib
	includelib advapi32.lib
	includelib user32.lib
	includelib kernel32.lib

		assume fs:flat

;-------------------------------------------------------------------------------
;				CONST
;-------------------------------------------------------------------------------
.const
	DIALOG_1	=10
	DIALOG_2	=40
	ICO		=30

	S_PROGNAME	=11
	S_STATUS	=32
	S_FILENAME	=13
	S_FILESIZE	=14
	S_BYTES		=15
	S_WRITE		=16
	S_SEP		=17
	S_CRACK		=18
	C_FILENAME	=19
	C_FILESIZE	=20
	C_BYTES		=21
	C_WRITE		=22
	C_SEP		=23
	C_CRACK		=24
	B_CRACK		=25
	B_RESTORE	=26
	B_SOURCE	=27
	B_ABOUT		=28
	B_EXIT		=29
	S_CRKR		=30
    S_BYS       =100


	A_PROGRAM	=45
	A_EXENAME	=46
	A_CRACKER	=47
	A_INFO		=49
	A_DATE		=51
	A_FIRSTWWW	=52
	A_SECONDWWW	=53
	A_EXIT		=54
	A_COMBOBOX	=55
	A_INFOLABEL	=56


DlgProc		PROTO	:DWORD,:DWORD,:DWORD,:DWORD
AboutProc	PROTO	:DWORD,:DWORD,:DWORD,:DWORD
ClearCrack	PROTO
Patch		PROTO	:DWORD,:DWORD,:DWORD,:DWORD
SetText		PROTO	:DWORD,:DWORD,:DWORD
RWProc		PROTO	:DWORD,:DWORD,:DWORD,:DWORD,:DWORD
Check		PROTO	:DWORD


;----------------------------------------------------------------------------
;				DATA?
;----------------------------------------------------------------------------
.data?

	stBrowseDir	BROWSEINFO	<?>
	szDisplayName	db	1024 dup (?)
	szTempBuf	db	1024 dup (?)
	szTempPatch	db	1024 dup (?)
	hFont		dd	?	
	hK		dd	?
 
 open_dialog     OPENFILENAME    <?>
        hFile           dd          ?
        _maping         dd          ?
        _mapView        dd          ?
        _font           dd          ?
        _sciezka        db  2048    dup (?)
;----------------------------------------------------------------------------
;				CODE
;----------------------------------------------------------------------------
.code
; ###########################################################################
;Main Dialog
szOk		db "OKi!",0
szNotFound	db "Not found",0
szBadSize	db "Bad size",0
szBadBytes	db "Bad bytes",0
szSep2		db "----------------",0
szCrackedOk	db "Complete!",0
szRestoredOk	db "Restored",0
szIsCracked	db "IS cracked",0
szNotCracked	db "NOT cracked",0
szAborted	db "Aborted",0

szNothing	db "-",0
szMutex	db "Mutex",0

szInfoFolder	 db " ",0
ofFiles	dd	offset szFile01
ofOffsets	dd	offset szOffsets01
ofBytesOld	dd	offset szBytesOld01
ofBytesNew	dd	offset szBytesNew01
szFirstShell	db " ",0



szCracker        db "Cracked by K3nny - K3NNY@SEZNAM.CZ", 0
szDate           db "23.8.2003", 0
szFSb          db "40 960 bytes", 0
szProgramName    db "XXX crackme #1", 0
_filter          db 'cme1.exe', 0 ,'cme1.exe',0,0
szInfoApp        db " ", 0
szSecondShell      db " ", 0
szExeName          db 'cme1.exe',0
_selectfile     db 'Choose target file:'


iFilesx          dd  01h
iSizesx          dd  0A000h
iBytesx          dd   02Dh
szFile01         db "cme1.exe", 0

szOffsets01    dd 03C40h,03C41h,03C42h,03C43h,03C44h,03C45h,03C46h,03C47h,03C48h,03C49h,03C4Ah,03C4Bh,03C4Ch,03C4Dh,03C4Eh,03C4Fh,03C50h,03C51h,03C52h,03C53h
                dd 03C54h,03C55h,03C56h,03C57h,03C58h,03C59h,03C5Ah,03C5Bh,03C5Ch,03C5Dh,03C5Eh,03C5Fh,03C60h,03C61h,03C62h,03C63h,03C64h,03C65h,03C66h,03C67h,03C68h,03C69h,03C6Ah,03C6Bh,03C6Ch

szBytesOld01    db 037h,035h,034h,033h,031h,033h,035h,033h,037h,039h,038h,034h,033h,039h,034h,036h,034h,035h,039h,034h
                db 030h,031h,036h,037h,039h,031h,030h,030h,033h,037h,034h,031h,030h,033h,035h,030h,038h,031h,035h,030h,030h,037h,030h,034h,039h

szBytesNew01    db 00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h
                db 00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h,00h


; ###########################################################################
;----------------------------------------------------------------------------
;				START
;----------------------------------------------------------------------------
start:



	invoke	CreateMutexA,0,0,offset szMutex
	invoke	GetLastError
	.if	al!=ERROR_ALREADY_EXISTS
	invoke	DialogBoxParamA,400000h,DIALOG_1,0,offset DlgProc,0
	.endif



	invoke	ExitProcess,0



;----------------------------------------------------------------------------
;				CRACK
;----------------------------------------------------------------------------
DlgProc	proc	uses edi esi ebx hWnd:DWORD, wmsg:DWORD, wParam:DWORD, lParam:DWORD
LOCAL	_temp1,_temp2:DWORD

	xor	ebx,ebx
	mov	esi,hWnd

	movzx	eax, word ptr [wmsg]
	cmp	ax, WM_INITDIALOG
	jz	_initdlg
	cmp	ax, WM_CLOSE
	jz	_wmdestroy
	cmp	ax,WM_COMMAND
	jz	_wmcommand

	xor	eax, eax
	ret

;-------------------------
;	WM COMMAND
;-------------------------
_wmcommand:
	movzx	eax, word ptr [wParam]

	cmp	ax, B_ABOUT
	jz	_about
	cmp	ax, B_EXIT
	jz	_wmdestroy
	cmp	ax, B_SOURCE
	jz	_source
	cmp	ax, B_CRACK
	jz	_crack
	cmp	ax, B_RESTORE
	jz	_restore

	xor	eax,eax
	ret

;------------------
;	CRACK
;------------------
_crack:
	invoke	ClearCrack
	invoke	Patch,offset ofBytesOld,offset ofBytesNew,offset szIsCracked,offset szCrackedOk
	ret

;------------------
;	RESTORE
;------------------
_restore:
	invoke	ClearCrack
	invoke	Patch,offset ofBytesNew,offset ofBytesOld,offset szNotCracked,offset szRestoredOk
	ret

;------------------
;	SOURCE
;------------------
_source:
	invoke GetOpenFileName, addr open_dialog
        test    eax,eax
        jz      _n


_n: ret
;------------------
;	ABOUT
;------------------
_about:
	invoke	DialogBoxParamA,400000h,DIALOG_2,esi,offset AboutProc,0
	ret

;-------------------------
;	WM DESTROY
;-------------------------
_wmdestroy:
	invoke	EndDialog,esi,ebx
	ret

;-------------------------
;	WM INITDIALOG
;-------------------------
_initdlg:

	invoke	CreateFontA,14,7,ebx,ebx,700,ebx,ebx,ebx,1,ebx,ebx,ebx,ebx,ebx
	mov	hFont,eax

	

	invoke	SetText,S_PROGNAME,offset szProgramName,esi

invoke	CreateFontA,10,5,ebx,ebx,700,ebx,ebx,ebx,1,ebx,ebx,ebx,ebx,ebx
	mov	hFont,eax

	invoke	SetText,S_CRKR,offset szCracker,esi
	invoke	SetText,C_SEP,offset szSep2,ebx
	invoke	SetText,A_EXENAME,offset szExeName,ebx
	invoke	SetText,S_BYS,offset szFSb,ebx
	invoke	SetText,A_DATE,offset szDate,ebx
	invoke	ClearCrack

	invoke	LoadIcon,400000h,ICO
	invoke	SendMessage,esi,WM_SETICON,1,eax

		mov     eax, offset open_dialog
        assume  eax:PTR OPENFILENAME

  		mov     [eax].lStructSize,sizeof open_dialog
        push    hWnd
        pop     [eax].hWndOwner
        mov     [eax].hInstance,ebx
        mov     [eax].lpstrFilter, offset _filter
        mov     [eax].lpstrFile, offset _sciezka
        mov     [eax].nMaxFile,2048
        mov     [eax].lpstrTitle, offset _selectfile
        mov     [eax].Flags, OFN_FILEMUSTEXIST or OFN_PATHMUSTEXIST or OFN_LONGNAMES \
                         or OFN_EXPLORER or OFN_HIDEREADONLY  or OFN_OVERWRITEPROMPT
        ret
DlgProc	endp


;----------------------------------------------------------------------------
;				ABOUT
;----------------------------------------------------------------------------
AboutProc	proc	uses edi esi ebx hWnd:DWORD, wmsg:DWORD, wParam:DWORD, lParam:DWORD

	mov	esi, hWnd
	xor	ebx,ebx
	movzx	eax, word ptr [wmsg]

	cmp	ax, WM_INITDIALOG
	jz	_initdlg
	cmp	ax, WM_COMMAND
	jz	_wmcommand

	xor	eax,eax
	ret

;-------------------------
;	WM DESTROY
;-------------------------
_wmdestroy:
	invoke	EndDialog,esi,ebx
	ret

;-------------------------
;	WM COMMAND
;-------------------------
_wmcommand:
	movzx	eax, word ptr [wParam]
	cmp	ax, A_EXIT
	jz	_wmdestroy
	
	mov	ecx,offset szFirstShell
	cmp	ax, A_FIRSTWWW
	jz	_www

	mov	ecx,offset szSecondShell
	cmp	ax, A_SECONDWWW
	jz	_www

	xor	eax,eax
	ret

	szOpen	db	'open',0

;------------------
;	GO WWW
;------------------
_www:
	invoke	ShellExecute,ebx,offset szOpen,ecx,ebx,ebx,SW_SHOWNORMAL
	ret

;-------------------------
;	WM INITDIALOG
;-------------------------
_initdlg:



	invoke	SetText,A_INFO,offset szInfoApp,ebx
	invoke	SetText,A_DATE,offset szDate,ebx







	ret
AboutProc	endp


;----------------------------------------------------------------------------
;				CHECK EXIST FILE
;----------------------------------------------------------------------------
; if file don't exist return 0
;----------------------------------------------------------------------------
Check	proc	uses edi	szDir:DWORD
LOCAL	stOpen:OFSTRUCT

	mov	esi, offset szFile01
	mov	edi, szDir
	invoke	lstrlen,edi
	add	edi,eax
	invoke	lstrlen,esi
	inc	eax
	mov	ecx,eax
	rep	movsb

	lea	eax,stOpen
	invoke	OpenFile,szDir,eax,OF_EXIST
	inc	eax
	ret
Check	endp

;----------------------------------------------------------------------------
;				CLEAR CRACK
;----------------------------------------------------------------------------
; esi - hWnd
;----------------------------------------------------------------------------
ClearCrack	proc
	mov	edi,offset szNothing
	invoke	SetDlgItemTextA,esi,C_FILENAME,edi
	invoke	SetDlgItemTextA,esi,C_FILESIZE,edi
	invoke	SetDlgItemTextA,esi,C_BYTES,edi
	invoke	SetDlgItemTextA,esi,C_WRITE,edi
	invoke	SetDlgItemTextA,esi,C_CRACK,edi
	ret
ClearCrack	endp

;----------------------------------------------------------------------------
;				SETTEX
;----------------------------------------------------------------------------
; esi - hWnd
;----------------------------------------------------------------------------
SetText	proc	id:DWORD,Sstr:DWORD,i:DWORD
	mov	edi,id
	invoke	SetDlgItemTextA,esi,edi,Sstr
	.if	i==esi
	invoke	SendDlgItemMessageA,esi,edi,WM_SETFONT,hFont,1
	.endif
	ret
SetText	endp

;----------------------------------------------------------------------------
;				PATCHING PROCEDURE
;----------------------------------------------------------------------------
Patch	proc	uses edi esi ebx	old:DWORD,new:DWORD,is_no:DWORD,ok_res:DWORD
LOCAL	hWnd:DWORD
LOCAL	hHandles[32*3]:DWORD

	xor	eax,eax

	mov	ecx, 32*3
	lea	edi,hHandles
	rep	stosd
	mov	hWnd,esi

	mov	ecx, iFilesx

.while	ecx!=0
push	ecx

	mov	eax, iFilesx
	sub	eax, ecx

;------------------------------------------------
;		FILE DIRECTORY
;------------------------------------------------

	mov	esi,offset ofFiles
	mov	esi, dword ptr [eax*4+esi]
	imul	eax, eax, 12
	lea	ebx,hHandles
	lea	ebx, [eax+ebx]

	push	esi
	mov	esi, offset szTempBuf
	invoke	lstrlen,esi
	mov	edi, offset szTempPatch
	mov	ecx, eax
	rep	movsb
	pop	esi

	invoke	lstrlen,esi
	mov	ecx, eax
	inc	ecx
	rep	movsb

;------------------------------------------------
;		OPEN FILE
;------------------------------------------------
	xor	edi, edi
	invoke	CreateFileA,offset szTempPatch,GENERIC_READ + GENERIC_WRITE,edi,edi,OPEN_EXISTING,FILE_ATTRIBUTE_NORMAL,edi
	inc	eax
	jz	_fileerr
	dec	eax

	mov	[ebx], eax
	add	ebx, 4

	invoke	CreateFileMappingA,eax,edi,PAGE_READWRITE,edi,edi,edi
	test	eax, eax
	jz	_fileerr
	mov	[ebx], eax
	add	ebx, 4

	invoke	MapViewOfFile,eax,FILE_MAP_ALL_ACCESS,edi,edi,edi
	test	eax, eax
	jz	_fileerr
	mov	[ebx], eax

pop	ecx
dec	ecx
.endw

	invoke	SetDlgItemTextA,hWnd,C_FILENAME,offset szOk

;--------------------------------------------------------
;		FILE SIZE
;--------------------------------------------------------
	mov	ecx, iFilesx
	mov	ebx, offset iSizesx
	lea	esi,hHandles
.while	ecx!=0
push	ecx

	invoke	GetFileSize,[esi],0
	cmp	eax, [ebx]
	jnz	_size_err
	add	esi, 12
	add	ebx, 4
pop	ecx
dec	ecx
.endw
	invoke	SetDlgItemTextA,hWnd,C_FILESIZE,offset szOk

;--------------------------------------------------------
;		OLD BYTES
;--------------------------------------------------------

	mov	ecx,iFilesx
	mov	esi, old
.while	ecx!=0
push	ecx
	mov	ebx, iFilesx
	sub	ebx, ecx

	mov	eax, offset ofOffsets
	mov	eax, [ebx*4+eax]
	mov	ecx, offset iBytesx
	mov	ecx, [ebx*4+ecx]
	mov	edi, [ebx*4+esi]

	imul	ebx, ebx, 12
	lea	ebx, [hHandles+ebx+8]
	mov	ebx,[ebx]

	invoke	RWProc,0,ebx,eax,edi,ecx
	test	eax, eax
	jnz	_mozenowe
pop	ecx
dec	ecx
.endw

	invoke	SetDlgItemTextA,hWnd,C_BYTES,offset szOk
	jmp	_zapis

;--------------------------------------------------------
;		NEW BYTES
;--------------------------------------------------------
_mozenowe:

	mov	ecx, iFilesx
	mov	esi, new

.while	ecx!=0
push	ecx
	mov	ebx, iFilesx
	sub	ebx, ecx

	mov	eax,offset ofOffsets
	mov	eax, [ebx*4+eax]
	mov	ecx, offset iBytesx	
	mov	ecx, [ebx*4+ecx]
	mov	edi, [ebx*4+esi]

	imul	ebx, ebx, 12
	lea	ebx, [hHandles+ebx+8]
	mov	ebx,[ebx]

	invoke	RWProc,0,ebx,eax,edi,ecx
	test	eax, eax
	jnz	_byteserr
pop	ecx
dec	ecx
.endw
	jmp	_fileerr2
;--------------------------------------------------------
;		WRITE BYTES TO FILE
;--------------------------------------------------------
_zapis:

	mov	ecx, iFilesx
	mov	esi, new
.while	ecx!=0
push	ecx
	mov	ebx, iFilesx
	sub	ebx, ecx

	mov	eax,offset ofOffsets
	mov	eax, [ebx*4+eax]
	mov	ecx, offset iBytesx
	mov	ecx, [ebx*4+ecx]
	mov	edi, [ebx*4+esi]

	imul	ebx, ebx, 12
	lea	ebx, [hHandles+ebx+8]
	mov	ebx,[ebx]

	invoke	RWProc,1,ebx,eax,edi,ecx
pop	ecx
dec	ecx
.endw

	invoke	SetDlgItemTextA,hWnd,C_WRITE,offset szOk
	jmp	_allok

;------------------------------------------------
;		ERRORS
;------------------------------------------------
_fileerr:
	pop	ecx
	invoke	SetDlgItemTextA,hWnd,C_FILENAME,offset szNotFound
	jmp	_err

_fileerr2:
	invoke	SetDlgItemTextA,hWnd,C_FILENAME,is_no
	jmp	_err

_size_err:
	pop	ecx
	invoke	SetDlgItemTextA,hWnd,C_FILESIZE,offset szBadSize
	jmp	_err

_byteserr:
	pop	ecx
	invoke	SetDlgItemTextA,hWnd,C_BYTES,offset szBadBytes
_err:	mov	eax, offset szAborted
	mov	ok_res,eax

;------------------------------------------------
;		ZAMKNIJ HANDLE PLIKOW
;------------------------------------------------
_allok:
	invoke	SetDlgItemTextA,hWnd,C_CRACK,ok_res

	lea	esi,hHandles
	mov	ecx,iFilesx
.while	ecx!=0
push	ecx
	invoke	CloseHandle,[esi]
	invoke	CloseHandle,[esi+4]
	invoke	UnmapViewOfFile,[esi+8]
	add	esi,12
pop	ecx
dec	ecx
.endw
	ret
Patch	endp

;----------------------------------------------------------------------------
;			READ/WRITE PROCEDURE
;----------------------------------------------------------------------------
; 0 - ok
; 1 - bad
;----------------------------------------------------------------------------
RWProc	proc	uses edi esi ebx	rw:DWORD,view:DWORD, offsets:DWORD,bytes:DWORD,_ile:DWORD	; eax = 0 -read, 1 -write
	mov	ecx, _ile
	mov	edi, view
	mov	esi, bytes
	mov	edx, offsets
;-------------------------------read / write??
	mov	eax, rw
	test	eax, eax
	jnz	_zapis
_sprawdz:
	lodsb
	mov	ebx, [edx]
	add	edx, 4
	cmp	byte ptr [ebx+edi],al
	jnz	_blad
	loop	_sprawdz
	jmp	_okej
_zapis:
	lodsb
	mov	ebx, [edx]
	add	edx, 4
	mov	[ebx+edi], al
	loop	_zapis
;---------------------------------------
_okej:
	xor	eax, eax
_ret:	ret
_blad:
	xor	eax, eax
	inc	eax
	jmp	_ret
RWProc	endp

	db	'PunK'

end start
wdz
	jmp	_okej
_zapis:
	lodsb
	mov	ebx, [edx]
	add	edx, 4
	mov	[ebx+edi], al
	loop	_zapis
;---------------------------------------
_okej:
	xor	eax, eax
_ret:	ret
_blad:
	xor	eax, eax
	inc	eax
	jmp	_ret
RWProc	endp

	db	'PunK'

end start
bx	rw:DWORD,view:DWORD, offsets:DWORD,bytes:DWORD,_ile:DWORD	; eax = 0 -read, 1 -write
	mov	ecx, _ile
	mov	edi, view
	mov	esi, bytes
	mov	edx, offsets
;-------------------------------read / write??
	mov	eax, rw
	test	eax, eax
	jnz	_zapis
_sprawdz:
	lodsb
	mov	ebx, [edx]
	add	edx, 4
	cmp	byte ptr [ebx+edi],al
	jnz	_blad
	loop	_sprawdz
	jmp	_okej
_zapis:
	lodsb
	mov	ebx, [edx]
	add	edx, 4
	mov	[ebx+edi], al
	loop	_zapis
;---------------------------------------
_okej:
	xor	eax, eax
_ret:	ret
_blad:
	xor	eax, eax
	inc	eax
	jmp	_ret
RWProc	endp

	db	'PunK'

end start