Cracking Tutorials by +ORC
+ORC 可算是 Reverse Engineering 界的祖師，他有一群直接或間接的學徒，但沒有多少人知道他的真正身份，猜測他可能是荷蘭人，退休大學教授。
由於他以 "+" 符號加在稱號前，他的追隨者亦多以此為誌，在自己稱號旁加上 "+" 符號。
他多數從程式的 dead listing 著手，以一種「禪」道精神來領悟程式的流向，理智地追縱程式脈胳，找出最有品味的破解方法。
他喜愛把程式碼列印出來，一邊研究，一邊享受「馬天尼混伏特加」。
現在已很少見到 +ORC 的猫影，大概已經「退出江湖」。
Lesson1 An approach
Lesson 2 Tools and tricks of the trade
Lesson 3.1 Hands on: Paper Protections (1)
Lesson 3.2 Hands on: Paper Protections (2)
Lesson 4.1 Time Protections - An introduction
Lesson 4.2 Time Protections - Part 2
Lesson 5.1 Disk and CDROM access (basic)
Lesson 6.1 Funny tricks (1)
Lesson 8.1 How to crack Windows, an approach
Lesson 8.2 How to crack Windows, a deeper approach
Lesson 9.1 How to crack Windows, hands on (1)- the "data constraint" trick
Lesson 9.2 How to crack Windows, hands on (2)- PaintShopPro
Lesson 9.3 How to crack Windows, hands on (3)- the "dead listing" approach
Lesson A Advanced cracking: Internet cracking (Unix)
Lesson C3 How to crack Windows, hands on (4)- Instance Access
+HCU Academy of Cracking
+HCU 是一群研究 Cracking 與 Reverse Engineering 的愛好者，聚在一起切磋學問的組織。
他們組織鬆散，各學員按照組織所定題目，自己找尋研究目標，和發表研究論文。
+HCU 成員的作品普遍獲高度讚許，很多已脫離「破解保護」的層面，進入「倒譯程式」的境界。
從名稱上的 "+" 號可知，+HCU 學員多數是 +ORC 的追隨者或仰慕者。
Project 0: Cracking Wdasm
How to crack Wdasm6 (very useful for newbies)
How to crack Wdasm6 (another nice approach)
How to crack Wdasm7
How to crack w32dasm version 8
How to carck w32dasm version 8--another approach
Quick "Non-Crack" for all Wdasm version (hilarious, but it works)
Cracking W32dasm version 8.5
W32Dasm version 8.0 Save re-enabling (How to get our dialogs and routines inside our targets)
W32Dasm version 8.7 the textfile problem (An hidden memory mover)
Project 1: Cracking the Tools you need
How to register HexWorkshop v2.52 (32bit)
Hex Workshop 32 v. 2.53(A weak protection scheme is worst than no protection scheme at all)
Hexpert32, Version 3.0.05(Cracking the tools of the trade)
Cracking HEdit 2.0(using wdasm as a debugger)
ULTRAEDIT-32 V. 4.40a(Slight Variations of the Serial Number-based protection scheme)
Reverse Engineering UltraEdit-32 4.40a(Cracking "blacklisted" Hex/Text Editors)
Cracking THE tool of the trade (Interactive Disassembler Pro v3.7, bye bye Wdasm)
SOURCER 7(efficiency of a well positioned BPINT under DOS)
Interactive Disassembler Pro v3.7 Demo(II)(How to load the previous databases)
ULTRAEDIT 5.00 S/N Generator(a very funny dynamic addressing process as copy procedure)
winrar 95 ver.2.0: the guts of a simple protection(why keygenerating when you can patch them on the fly?)
Cracking Wingdis 2.12(Preparing ourselves for 'real' Java cracking)
Project 2: Cracking Softice
Cracking Loader32/NmTrans.dll (How it all started)
More on Winnie (Another approach to crack SoftIce 3.01 14 day trial)
Registry joggling (Another short approach)
WiniceNT cracking, a first approach (How EXE checksums work)
An introduction to virtual devices cracking (An important lesson)
Deeper WiniceNT cracking, working with HIEW (An important lesson, deepens our undesrtanding of NT-Winice)
Short and effective Win95's Softice cracking (The final point in cracking Godot for Win95, from Sri Lanka!)
WinNT-Winice reverse engineering, another approach (The final point in cracking Godot for WinNT, this concludes the whole project2!)
WinNT-Winice reverse engineering, some explanations (There is never a final point in cracking... a lesson for everyone!)
Winice 3.01 time-stamp encryption algorithm (Timestamping... and timedestamping)
How to install Soft-Ice 3.01 Win95 (trial version)
Melted MeltICE (SoftIce 3.xx detection and another lesson for shareware programmers)
Little patch to get back the AZERTY keyboard (The new winice.exe version 3.21 is an US copy so it will turn your keyboard into QWERTY)
ADD-ON 1: NO MORE annoying anti SOFT-ICE tricks
ADD-ON 2: BoundsChecker time limit defeated (The 'Persistent file' protection scheme)
ADD-ON 3: BoundsChecker 5.02 Visual C++ Edition ('Hardcoded' serial numbers)
ADD-ON 4: An interesting tool: Numega Smartcheck 5.0(Echoing a silly "install" and trial protection scheme)
ADD-ON 5: An interesting tool - Numega's Smartcheck, how to defeat all protections (visual basic 1-5 and other languages as well)
ADD-ON 6: How to crack ANY program that uses the TL32V2.DLL!
Project 3: Dongle reverse engineering
Cubase -Dongle protection cracking(the main tricks)
Dongle reverse engineering(Hasp dongles)
Dongle cracking: NetXRay 1.1.3(A Very Easy Dongle Protection)
Simple unix busting(the microphar dongle galore)
Dongle protection reversing (HASP) - Pinit dongle testing
Zen and the Art of Dongle Cracking(A somehow 'general' essay about dongles)
Reverse Engineering MATLAB 5 - Part I: Dongle Protection(Simple dongle reversing: the 'alien dll date' trick)
Pushing the Envelope with HASP(De-Hasping, zip cracking and other marvels)
SSI Win32 Dongle Protection(Initial workaround for difficult Win32 targets)
Dongle Bashing ~ End of the dongle old aera(How a single +HCU reverser can easily blow a whole commercial sector out of history)
Marx Crypto Box, the most Secure device ever made("Protection Plus Professional")
Unplugging a dongle protection(unplugging technical library from Micro house)
Bashing LPT-Parasites(DONGLES: The weak brothership between hard- and software)
Undocumented HASP - Part I(what d'you think of all the hype about HASP?)
Dongle DEJAVU(Revealing sentinel Pro main code)
Undocumented HASP - Part II "xDEAD:xBEEF: extending HASP manufacturer's services"
How to crack an hardcore dongle-protected program: Cracking 'Security Lock Number' ('SLN')
Project 4: CD-ROM faking
EMULATE CD-ROM (an ASM file)(Emulating MSCDEX)
Brief Tutorial on CD Access Based Protection Schemes Under Windows(Cracking Virtua Fighter PC)
WarLords 3 Cd-Check(A Very Simple Protection)
CD-Rom reversing MechWarrior2 Mercenaries(Another Approach to the Cd-Check scheme)
Cracking the Mystique Patch for Tombraider(the write random file trick)
CD ROM from top to down(MSCDEX, reversing drivers and CD-ROM related interrupts)
InstallSHIELD Script Cracking(Object oriented cracking: INSTALL WIZARDS CRACKING)
Quake2 CD-Rom reversing(More about CD-ROM deprotections and Cd-Checks)
The cracking of "Age of Empires"(with a general digression about CD-based copy protections of most Windows95 games)
Oldies but Goodies(A Dos Game CD-check with Sourcer 7)
Project 5: Netscape reverse engineering
Cookies begone!
Killing those Javascript Messageboxes
Customizing Netscape's buttons and menus
Project 6: Save disable targets
Cracking "Save disabled" protections (The "dead listing" and the "live" approaches explained)
Razzia's tutorial for crippled programs (The beautiful creation of the "RazziaPad")
W32Dasm Version 8.0 Save re-enabling__NEW!__(How to get our dialogs and our routines inside our targets)
An interesting tool: Screen Ruler (The "pixel shortcut" method: How to transform a target adding functionalities to it)
ARJSHELL DISABLED SAVE FUNCTION (A location helds the secret)
Extending the IDA Script Language (A First Stab)
Cracking MicroCal Origin 5.0 in 3 Simple Ways (A First Stab)
Project 7: "Most stupid protection" award 最 笨 蛋 保 護 選 舉
Hex Workshop 32 v. 2.53 (Weak protection schemes are worse than no protection at all)
Claris Home Page version 2.0 (Stupid time trial limits)
SmartDraw for Windows95, Version 3.11 (Heawy Stupid anti-crackers protection)
A pretty stupid scheme: Spam Exterminator (it's all there... "autocracked")
Another "blacklist" protection (Hypersnap-DX version 3.02 Key generator, ASM CODE)
PhotoShop 4.0 / Digimarc (Commercial stupidity - Digimarc downfall)
SoftWrapper - Cracking Windows Calculator? (how to reverse engineer a simple "anti-Winice" protection scheme)
Cracking WinHacker95 2.0 (MSVCRT.dll reverse engineering)
Kremlin 1.1, a stupidly protected encryption utility (An useful encryptor for our studies, btw)
Cracking Comments v1.3 (If they would only make it so easy for us every time)
EnTray-Vous, Merci (How NOT to use the Registry to protect your software)
Ulead PhotoImpact Trial 3.01 ("Protections" that tell you the name of the calling dll and of the calling function)
iniquity's inequality protection scheme (and some tips about pascal reverse engineering)
"Mental" cracking: techfacts95 v1.3 (Am I dreaming?)
Bypassing Ready made Commercial Protection Schemes (RSAgent32) - Cracking Xing Technology's Mpeg Player
DLL-based schemes are *dead* (A long overdue lesson for shareware programmers)
Bullet Proof FTP V1.0 (hidden, bloated exe creation)
Cracking SendMail 2.0 for Windows NT (Obvious Name Protections)
An interesting tool: Numega Smartcheck 5.0 (Echoing a silly "install" and trial protection scheme)
Cracking Unlocker for newbyes (Defeating Lame Commercial Protection Schemes)
Symantec Visual caf� trial version 1.0 (a very silly protection scheme on a very interesting target)
The Easy Protection Schemes And The Lazy Protectionists (InstallShield Software Corporation protection schemes)
BEGINNERS: Prassi CD-REP trial stupid protection (dead listing a very easy protection scheme)
BEGINNERS: Awesome AW: MOST STUPID PROTECTION OF THE YEAR 1997! 最 笨 蛋 冠 軍 獎 作 品 (Hardcoded and unencrypted registration codes: a touristic tour for beginners)
BEGINNERS: Big tent, little circus (Observations and Thoughts springing from an mIRC 5.3 crack)
Project 8: Visual Basic reverse engineering
How to crack all Visual Basic programs
Visual Basic 4 cracking for newbyes
A decompiler is enough!
A decompiler is more than enough!
Reverse Engineering VBX Custom Controls
An Explanation of how Make_Mak for Visual Basic Works,
Visual Basic - VB40032.DLL comparison code
Like watching a movie!
MCSE MCNE tests - BeachFront Quizzer
Happy VB5 cracking
OCX Control Highlights - Licensing schemes
An example of VB Cracking using SmartCheck
Inside the VB3 .EXE
BEGINNERS: Pluckit 3.0 Hip Hip Hurray for Smartcheck
Visual Basic Unprotection...
Project 9: Microsoft bashing
More essays will come soon
Project A: VisualC++ *.DLL reverse engineering
More essays will come soon
Project B: Demos and Intros reverse engineering
More essays will come soon
Other useful essays
Cracking (black and blue) Java Workshop 2.0
Cracking Symantec Visual cafe trial version 1.0(a very silly protection scheme on a very interesting target)
Cracking Tutorials by fravia+
fravia+ 是 reverse engineering 界內的著名高手，
他對「微軟」以及政界商界的權勢深感疾惡，經常身體力行地打擊和排擠這些「企圖獨霸世界知識權利」的惡勢力。
破解 VB 產品，可能就是他對付微軟的其中一種手段。他喜愛調製和享受雞尾酒，有點像 +ORC 的風雅。
事實上，fravia+ 十分崇尚 +ORC 的「禪道」理論，認為 reverse engineering 不單止是一門技術，
還是一種追求真理的實踐過程。
Windows 3.1: Taskman disassembling
Lesson 1.a, Taskman part 1
Lesson 1.b, Taskman part 2
Windows 95: Filemon.exe disassembling
FILEMON 是 Cracker 常用的好工具，它可以監察某程式執行時，其他檔案被讀 / 寫的紀錄。
Fravia 憑藉深厚功力，竟然能夠把一個 .exe 還原成為 C 語言的原程式，過程完全披露，令人嘆為觀止！
Lesson 2a: Introduction to filemon
Lesson 2b: reverse engineering without source code
Lesson 2c: filemon reversed
Lesson 2d: back to main
Lesson 2e: vxd vagaries and mysteries
Art of Cracking
來自五湖四海，關於破解的資料。
「軟冰」九X 四點零一, 組件
一
二
三
四
五
六
(用 copy 指 令 順 序 合 併 各 組 件 成 為 .zip, 若 果 copy 也 不 懂 得 用 ， 就 別 下 載 了 。)
「軟冰」NT 四點零一, 組件
一
二
三
四
五
六
(用 copy 指 令 順 序 合 併 各 組 件 成 為 .zip，
請 注 意 ， 安 裝 SI 前 ， 要 通 過 一 項 考 試 ， 就 是 拆 解 一 個 密 碼 鎖 。 傳 聞 Numega 認 為 ， 如 果 這 樣 簡 單 的 考 試 都 不 合 格 ， 便 沒 資 格 使 用 這 東 西 云 云 。)
Cracking Softice
Softice Manual 使用手冊
Softice Command Reference 指令手冊
Finely written set of cracking tutorial in .com format
Cracking using W32Dasm, in .exe format
Example of cracking, Target:
Softart's Deskey
Assembly for Crackers 組合語言的基本知識
How to Crack WinAMP
How to make key-generators?
Example of making Key Generator, Target: Exile I - Escape from the Pit
A short tutorial on how to use softice, for beginners
A very short tutorial on cracking serial number protection, for beginners
A tutorial with the target included, for beginners
Tutorial
1
2
3
4
5
6
7
8
9 by TKC
Tutorial
1
2
3
4
5 by Flu[X]
The Amateur Crackist Tutorial Version 1.3 by Specular Vision
Cracking 101
1
2
3
4 by Buckaroo Banzai
The Cracking Manual written by the Cyborg
How to Crack by Charles Petzold
Examples of IBM PC Cracks: MEan-18 Golf by Accolade
Cracking a Self-Booter
Cracking on the IBM PC Part
I,
II
IBM Disk Cracking Made Simple by Phobos
How to crack Circuit MakerThis tutorials help to crack the popular "time-lock".
Cracking Sale AgentThis tutorial deals with removing RSA wrappers from "Try&Buy" software.
Anti-Anti-Debugging Tricks
「保護主義者」為了防止別人破解程式，想盡辦法令程式難以解讀和追縱。
可是愈保護得密，便愈吸引人來研究。要拆解這些額外保護的程式，必須先了解他們的保護方法。
Defeating Encryption
Anti-Debugging Tricks
Anti-Anti-Debugging Tricks
Anti-SoftIce Tricks
Anti-debugger FAQ: Over 100 files, ALL anti-debugger tricks you can imagine.
Pascal Anti-debugging code
1
2
3
4
5
