Most of you probably don’t know how time consuming it is to find commercial programs to use in tutorials that fit the specific criteria you are trying to teach. It takes a LONG time. Let me give you an example.
I am writing a tutorial (one of the future one’s in the Beginning Reverse Engineering series) about dealing with Delphi programs. So you go to Tucows or Download.com and download a bunch of “try it before you buy it” programs, as these will have some sort of restriction on them. In this particular case I downloaded about 60 programs. Half were packed with packers that I just don’t feel like dealing with as it just takes too long (Themida, newer Armadillo etc.) – it’s easier to just find a different program, at least until I get into packing.
Of the 30 remaining programs, 8 are written in .NET, 7 are in VB, 12 are in VC++, 2 are in Delphi, and one is in some obscure format I don’t even want to get into. So that leaves two programs.
I then install the first program, load it in Olly, check it out and see what kind of protections it has. Unfortunately, this one is too easy (a single patch and it’s registered.)
I finally load the last program and run it. It looks pretty good. It has a time trial which is what I am talking about in the tutorial. I then do the various things you have to do to see the difficulty (are there strings? intermodular calls? Is it too easy?) I find that this program has everything I need. I then go to the registration screen and it asks for a username and serial. I enter the usual gobbledygook and the registration window closes. Hmmm. Maybe that’s a good thing. Maybe it doesn’t display when you got an incorrect serial, which means that it will be harder to crack. This could be a good teaching thing. So I restart the app and start looking around a little and then discover that the “UNREGISTERED!” text is not on the main window anymore. I then go into the registration screen and it says I’m registered. What!? I un-install the program, thinking for the first time in history, R4andom as a username and 1212121212 as a serial actually worked! I then enter a compeletly different name and serial and the app registers again! After some investigation, I discovered that the moron who programmed it didn’t bother doing any checks for if the username and serial were correct, only that one was entered!!!!
I have to tell you I was mad and almost emailed the author, but then I realized, what would I say? “You’re piece of crap registry scheme doesn’t work. Can you please fix it so I can write a tutorial on how to bypass it?”
It just goes to show you what will inevitably be on my tombstone: “No good dead goes unpunished”.