Task 2 - Partial ;) Thursday, 04-Feb-99 19:23:25
Greetings crackers, I searched the "Thank you" string in WDasm * Possible Reference to String Resource ID=61245: "Thank you for registering %s." | :0040B78C 683DEF0000 push 0000EF3D Looking at the code above this string we can see: :0040B742 85C0 test eax, eax :0040B744 0F8572020000 jne 0040B9BC <----- Beggar off Cracker ! :0040B74A 8B45EC mov eax, dword ptr [ebp-14] :0040B74D FF701C push [eax+1C] :0040B750 C7405C01000000 mov [eax+5C], 00000001 * Reference To: USER32.GetParent, Ord:0115h | :0040B757 FF151C594300 Call dword ptr [0043591C] :0040B75D 50 push eax :0040B75E E8AF170100 call 0041CF12 :0040B763 FF701C push [eax+1C] * Reference To: USER32.GetMenu, Ord:0101h | :0040B766 FF1544594300 Call dword ptr [00435944] :0040B76C 50 push eax :0040B76D E875460100 call 0041FDE7 :0040B772 50 push eax :0040B773 8B4DEC mov ecx, dword ptr [ebp-14] :0040B776 FF711C push [ecx+1C] * Reference To: USER32.GetParent, Ord:0115h | :0040B779 FF151C594300 Call dword ptr [0043591C] :0040B77F 50 push eax :0040B780 E88D170100 call 0041CF12 :0040B785 8BC8 mov ecx, eax :0040B787 E8CE62FFFF call 00401A5A <---- This change the menu from 'Register' to 'Unregister' * Possible Reference to String Resource ID=61245: "Thank you for registering %s." | :0040B78C 683DEF0000 push 0000EF3D ............. When I loaded Memo95.exe in HexWorkshop i noticed the ready-only status of the file, so i had to set the flag off Now if we patch here: :0040B744 0F8572020000 jne 0040B9BC (offset ab44hex 0f85->0f84) We have our "Thank you" msg. but in the registry we have our fake code, so the 2nd time we run the proggie it checks for this code and says the it's wrong! If the name and code are empty when we re-run the proggie he doesn't tell nothing 'bout the patch, but it's unregistered! I read this message: "The program has been modified!", but when i patched the proggie it didn't show nothing Peraphs the intention of the programmer was to check for a checksum (i thinked that the string "8530" in WDasm could be useful, but nothing...) I will spend other time on this task..... Peace Kali ps....ugly english...pardon ;) Kali |
KALI: Project 6 (03-Feb-99 19:05:56) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.