pRINCESSNOP conditional JMPThu Dec 17 20:57:43 1998 Solution Task #3Conditional jump require to be NOPed is the JNE offset :0043FA09* Referenced by a (U)nconditional or (C)onditional Jump at Address:|:0043F958(C)|………………….0043F9EE 8B45FC mov eax, dword ptr [ebp-04]:0043F9F1 50 push eax:0043F9F2 8D55F8 lea edx, dword ptr [ebp-08]:0043F9F5 8B83F8010000 mov eax, dword ptr [ebx+000001F8]:0043F9FB E8B4D6FDFF call 0041D0B4 ß--------------------------- This call calculates our serial #:0043FA00 8B55F8 mov edx, dword ptr [ebp-08] ß------------------ Our Serial #:0043FA03 58 pop eax:0043FA04 E8FB41FCFF call 00403C04:0043FA09 752E jne 0043FA39 ß-------------------------------------- Jump if NOP ed will allow any number or name combination:0043FA0B A1209B4400 mov eax, dword ptr [00449B20]:0043FA10 8B00 mov eax, dword ptr [eax]:0043FA12 E8D5AFFEFF call 0042A9EC:0043FA17 A1109D4400 mov eax, dword ptr [00449D10]:0043FA1C 803800 cmp byte ptr [eax], 00:0043FA1F 750C jne 0043FA2D:0043FA21 A1089D4400 mov eax, dword ptr [00449D08]:0043FA26 8B00 mov eax, dword ptr [eax]:0043FA28 E863ADFEFF call 0042A790PrincessTsk tsk.. Help requests in the WRONG place! by The Sandman , Fri Dec 18 06:20 im impressed by Latigo , Fri Dec 18 01:53 How by Princess , Thu Dec 17 22:27 Thanks! by Eternal Bliss , Fri Dec 18 07:09 Thanks! by Volatility , Thu Dec 17 22:37 Hummmmmm; :) by Jeff , Thu Dec 17 21:38