CorePlayer details

I have received numerous questions regarding the method of the CorePlayer crack. Now I would like to briefly describe the process.

PPC Reverse engineering on Mac OS can be an easy process if we know how to do it. There are several debugging and disassembler tools available for Mac OS that can be used for such purposes.  In this case I only used OTX v.16b disassembler and a simple hex editor 0xEd.

For me the easiest way is to look into the code itself produced by OTX. It is a simple GUI application and produces a text file of the application that we want to disassemble. The CorePlayer binary itself is only 5 MB but the text output produced by OTX is nearly 21 MB.

A part of the output looks like this:

  +188    0006e23c  409e0064    bne         cr7,0x6e2a0
  +192    0006e240  813f0000    lwz         r9,0x0(r31)
  +196    0006e244  a161003e    lhz         r11,0x3e(r1)
  +200    0006e248  80490000    lwz         r2,0x0(r9)
  +204    0006e24c  a0020074    lhz         r0,0x74(r2)
  +208    0006e250  7f8b0000    cmpw     cr7,r11,r0
  +212    0006e254  40be004c    bne+         cr7,0x6e2a0
  +216    0006e258  a0010040    lhz         r0,0x40(r1)
  +220    0006e25c  2f800001     cmpwi     cr7,r0,0x1
  +224    0006e260  40be0040    bne+         cr7,0x6e2a0
  +228    0006e264  80010044    lwz         r0,0x44(r1)
  +232    0006e268  80410038    lwz         r2,0x38(r1)
  +236    0006e26c  7f801000     cmpw     cr7,r0,r2
  +240    0006e270  419e0030    beq         cr7,0x6e2a0
  +244    0006e274  a0010042    lhz         r0,0x42(r1)
  +248    0006e278  805f00dc     lwz         r2,0xdc(r31)
  +252    0006e27c  5409073e    rlwinm     r9,r0,0,28,31
  +256    0006e280  7f824800    cmpw     cr7,r2,r9
  +260    0006e284  419e0034    beq         cr7,0x6e2b8
  +264    0006e288  3802ffff       addi         r0,r2,0xffff
  +268    0006e28c  2b800002    cmplwi     cr7,r0,0x2
  +272    0006e290  419d0010    bgt         cr7,0x6e2a0
  +276    0006e294  3809ffff       addi         r0,r9,0xffff
  +280    0006e298  2b800002    cmplwi     cr7,r0,0x2

Each line is one operation in the code. I do not want to go into details now of assembly coding. There are dozens of good sites dealing with programming.

So a very plain explanation of a line:

+240        0006e270  419e0030    beq         cr7,0x6e2a0

+240                               reference line number within a program block
0006e270                        overall line number
419e0030                        machine hex code
beq    cr7,0x6e2a0          assembly code


The registration of CorePlayer is linked to the unique Mac serial number of a particular machine where the player is installed. 

In the output of OTX we have to find the appropriate places where the software checks the registration status and decides whether it will run or not. CorePlayer uses a 3 level verification process:

1. is there a valid serial number entered and stored in the Users/user/.CorePlayer/config.xml file,
2. is there a valid user based on the Mac serial number and CorePlayer serial number to run the program and start the GUI,
3. is there a valid user based on the Mac serial number and CorePlayer serial number to start video playback.

As I had the valid CorePlayer serial numbers from the start I only had to find the places in the code where the Mac and CorePlayer serial number checks were executed. This is the hardest part but if someone has some experience in assembly language then it is relatively easy to find these places in the code. In this case for me the starting point was the place where the registration dialog is called:

 +1176    000139b0  7f801000    cmpw     cr7,r0,r2
 +1180    000139b4  409e0030    bne         cr7,0x139e4
 +1184    000139b8  a001005a    lhz         r0,0x5a(r1)
 +1188    000139bc  805d00dc    lwz         r2,0xdc(r29)
 +1192    000139c0  5409073e    rlwinm     r9,r0,0,28,31
 +1196    000139c4  7f824800    cmpw     cr7,r2,r9
 +1200    000139c8  419e00c0    beq         cr7,0x13a88
 +1204    000139cc  3802ffff       addi     r0,r2,0xffff
 +1208    000139d0  2b800002    cmplwi     cr7,r0,0x2
 +1212    000139d4  419d0010    bgt         cr7,0x139e4
 +1216    000139d8  3809ffff       addi     r0,r9,0xffff
 +1220    000139dc  2b800002    cmplwi     cr7,r0,0x2
 +1224    000139e0  409d00a8    ble         cr7,0x13a88
 +1228    000139e4  807e0044    lwz         r3,0x44(r30)
 +1232    000139e8  3ca05549    lis         r5,0x5549
 +1236    000139ec  3c80001f     lis         r4,0x1f
 +1240    000139f0  38c00000     li         r6,0x0
 +1244    000139f4  38845f94     addi     r4,r4,0x5f94      serialdialog
 +1248    000139f8  60a54744     ori         r5,r5,0x4744      'UIGD'
 +1252    000139fc  481556e5     bl         0x1690e0
 +1256    00013a00  7c7f1b79     or.         r31,r3,r3
 +1260    00013a04  4082001c    bne         0x13a20
 +1264    00013a08  48000068    b         0x13a70
 +1268    00013a0c  7fc3f378      or         r3,r30,r30
 +1272    00013a10  38800000    li         r4,0x0
 +1276    00013a14  38a0020c    li         r5,0x20c
 +1280    00013a18  4bfff879      bl         0x13290
 +1284    00013a1c  4800006c    b         0x13a88
 +1288    00013a20  3c400001    lis         r2,0x1
 +1292    00013a24  93c10058    stw         r30,0x58(r1)
 +1296    00013a28  38800217    li         r4,0x217
 +1300    00013a2c  38a10054    addi     r5,r1,0x54
 +1304    00013a30  38423290    addi     r2,r2,0x3290

If we do not want to call the registration dialog then we have to tell the program to jump over the registration call. So the actual place that we have to alter is before the dialog call:

+1180    000139b4  409e0030    bne         cr7,0x139e4

I have found 6 places where these or very similar verifications were executed and called. The basic pattern of the code looks like this:

  +240    0006e270  409e0030    bne         cr7,0x6e2a0
  +244    0006e274  a0010042    lhz         r0,0x42(r1)
  +248    0006e278  805f00dc     lwz         r2,0xdc(r31)
  +252    0006e27c  5409073e    rlwinm     r9,r0,0,28,31
  +256    0006e280  7f824800    cmpw     cr7,r2,r9

The easiest way is to alter the program flow and negate the relevant operations. In this way it skips the appropriate parts and will accept any Mac serial numbers and a valid CorePlayer serial number. In order to negate the operation we have to change the  line:

0006e270 409e0030        bne         cr7,0x6e2a0

into

0006e270 419e0030        beq         cr7,0x6e2a0

We have to use the hex editor to change the code at 6 different places in the binary and save the altered code. After this entering a valid serial will produce a fully working CorePlayer.

If someone wants to dive deeply into this topic I would recommend starting with this site: https://reverse.put.as/