Cracking Projects For Newbies

Task 2 - Partial ;)
Thursday, 04-Feb-99 19:23:25
    194.55.32.195 writes:

    Greetings crackers,

    I searched the "Thank you" string in WDasm

    * Possible Reference to String Resource ID=61245: "Thank you for registering %s."
    |
    :0040B78C 683DEF0000 push 0000EF3D


    Looking at the code above this string we can see:

    :0040B742 85C0 test eax, eax
    :0040B744 0F8572020000 jne 0040B9BC <----- Beggar off Cracker !
    :0040B74A 8B45EC mov eax, dword ptr [ebp-14]
    :0040B74D FF701C push [eax+1C]
    :0040B750 C7405C01000000 mov [eax+5C], 00000001

    * Reference To: USER32.GetParent, Ord:0115h
    |
    :0040B757 FF151C594300 Call dword ptr [0043591C]
    :0040B75D 50 push eax
    :0040B75E E8AF170100 call 0041CF12
    :0040B763 FF701C push [eax+1C]

    * Reference To: USER32.GetMenu, Ord:0101h
    |
    :0040B766 FF1544594300 Call dword ptr [00435944]
    :0040B76C 50 push eax
    :0040B76D E875460100 call 0041FDE7
    :0040B772 50 push eax
    :0040B773 8B4DEC mov ecx, dword ptr [ebp-14]
    :0040B776 FF711C push [ecx+1C]

    * Reference To: USER32.GetParent, Ord:0115h
    |
    :0040B779 FF151C594300 Call dword ptr [0043591C]
    :0040B77F 50 push eax
    :0040B780 E88D170100 call 0041CF12
    :0040B785 8BC8 mov ecx, eax
    :0040B787 E8CE62FFFF call 00401A5A <---- This change the menu from 'Register' to 'Unregister'

    * Possible Reference to String Resource ID=61245: "Thank you for registering %s."
    |
    :0040B78C 683DEF0000 push 0000EF3D
    .............
    When I loaded Memo95.exe in HexWorkshop i noticed the ready-only status of the file, so i had to
    set the flag off
    Now if we patch here:
    :0040B744 0F8572020000 jne 0040B9BC (offset ab44hex 0f85->0f84)
    We have our "Thank you" msg. but in the registry we have our fake code, so the 2nd time we run the proggie
    it checks for this code and says the it's wrong!
    If the name and code are empty when we re-run the proggie he doesn't tell nothing 'bout the patch, but
    it's unregistered!

    I read this message: "The program has been modified!", but when i patched the proggie it didn't show nothing
    Peraphs the intention of the programmer was to check for a checksum (i thinked that the string "8530" in
    WDasm could be useful, but nothing...)

    I will spend other time on this task.....

    Peace Kali

    ps....ugly english...pardon ;)

    Kali


Message thread:

KALI: Project 6 (03-Feb-99 19:05:56)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.