Little more than half way done with task 3 Saturday, 06-Feb-99 15:55:07
Well I gotta go kinda soon, so I thought I'd post what I have so far. I'll get to the other stuff later. a. Show what values of importance are returned in the PC's internal registers after the CALL 0040CCC0 has been executed. Well the only register that I thought that had a lot of value was the eax register. After coming back from call 0040CCC0 I've had eax contain FFFFFFFF, 00000001, and 00000000. 00000000 is the one that tells you you've found the right reg code as I'll explain in a sec. I'm not sure why it comes back with FFFFFFFF or 00000001. It has to do with the lines: 0040CCFA SBB EAX,EAX and then 0040CCFD SBB EAX,-01 Sometimes the sbb eax, eax sets eax to 00000000, then sbb eax, -01 sets eax to 00000001. Other times sbb eax, eax sets eax to FFFFFFFF, and then sbb eax, -01 does nothing to the register. Maybe someone with more asm knowledge can clear this up for me. I'd think that sbb eax,eax is some sort of subtraction and it would ALWAYS set eax to 00000000, but that doesn't seem to be the case. b. What is the reason for the ADD ESP, 00000008 instruction? BTW, register ESP is a STACK Register. This along with question 3 are the things I haven't figured out yet. c. The instruction TEST EAX,EAX is checking the eax register for two possible values, what are they and what do they signify? Well, I looked up the test instruction in the art of assembly book I downloaded, and it tells me that test logically ands the two. So for those of you familiar with the and instruction, test 00000000,00000000 would give you the answer of 00000000. Test 00000001,00000001 would give 00000001. This is important because the next instruction is JNZ 0040B9BC (or I guess JNE when your not in Softice). If the value of test eax, eax was 1 then your gonna take the jump and get the message that you don't have the right serial number. If it was 0, your registered! d. Where does the instruction JNE 0040B9BC take us to? This takes us to the old, "wrong serial number" crap. Question 2. Explain how this program compares our *fake* serial number against the *real* one. (hint, check the code between :0040CCC0 to :0040CCF9 ) Ok here's the code that I think is the important stuff with comments: :0040CCCE mov ecx, dword ptr [esp+10] ;point ecx to your reg code :0040CCD2 mov edx, dword ptr [esp+14] ;point edx to real reg code :0040CCD6 mov al, byte ptr [ecx] ;move first character of your code into al :0040CCD8 cmp al, byte ptr [edx] ;compare yours to what is should be :0040CCDA jne 0040CCFA ;not equal? get outta here :0040CCDC or al,al ;this will break us out when we're done comparing :0040CCDC je 0040CCF2 ;and this is where we'll head :0040CCE0 mov al, byte ptr [ecx+01] ;move your next character to al :0040CCE3 cmp al, byte ptr [edx+01] ;test your character again :0040CCE6 jne 0040CCFA ;they better equal or you heading to 0040CCFA :0040CCE8 add ecx, 00000002 ;increase the pointer by two so next time through we read the next two characters instead of the same ones we were reading :0040CCEB add edx, 00000002 ;ditto :0040CCEE or al, al ;make sure the value isn't :0040CCF0 jne 0040CCD6 ;well anyway repeat loop Ok, a few extra comments about that. Assuming you have the entire code right, that loop will go through and compare the first two characters, when they're all right it will go through again and do the next two, and again, and again until all 16 have been compared. However, after the 16th the loop will start back at the top and read in the 17th character from each (which I assume was set to 0 somewhere). It will compare them, they're the same continue on until it gets to: :0040CCDC or al,al At this point the value resulting from the or will be 0, and you will be taken out of the loop by jump following or. If ofcouse at any time any of the characters don't match up you'll be jumped to a message telling you you have the wrong code. Question 3. Explain how our User Name: Pirate Copy is converted into a 16 character hex code Can't answer yet. I wanna see how other people start this one, cause as I said I just started learning asm. Well I'm sure something in here is slightly inaccurate so someone post a followup and correct me :) Anyway thats what I've got to say. Cigam (Posting Moved) |
Cigam: Idea for forum... (06-Feb-99 00:22:48) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.