Re: jas's Thread for NEW newbys; Changing registers in ICE; Saturday, 06-Feb-99 15:18:05
Okay; now that we can use and show results from ice; and the instructions now state we can also deal with the serial routine I can now show another way to manipulate this program to reg by making only one change,,,as has been pointed out by Eternal Bliss and re-inforced by HarvestR...I decided not to comment on it in my notes yesterday because to have done so would have taken those unaware of it... Too Close to the actual serial...:) (NO; niether of you were out of line; its just that I had these terrible visions of all these posts arriving with serials...they did not materialize...I think the Forum is running well this time!!!) I also must admit that although I had found and seen my fake and the real serial being compared I never thought to change the register until I read EB's and HarvestR and the Princess's exchange on this matter...so to explain it in a way that a new newby will hopefully be able to follow....here goes: Okay taking this snippet of code and trying to follow The Sandmans task #2 to find various ways to reg this program without using a serial we can also step inside the Call here :0040CCC0: Stepping inside (f-8) the call at :00405C3D E87E700000 call 0040CCC0 We land HERE: * Referenced by a CALL at Addresses: |:00401D3D , :00401E74 , :00402194 , :00405C3D <<--this one , :0040B73A |:0041C424 , :0041C43D | :0040CCC0 83EC04 sub esp, 00000004 <<---land here :0040CCC3 833D24F1420000 cmp dword ptr [0042F124], 00000000 :0040CCCA 53 push ebx :0040CCCB 56 push esi :0040CCCC 7537 jne 0040CD05 :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] :0040CCD2 8B542414 mov edx, dword ptr [esp+14] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CCF0(C) | :0040CCD6 8A01 mov al, byte ptr [ecx] :0040CCD8 3A02 cmp al, byte ptr [edx] :0040CCDA 751E jne 0040CCFA :0040CCDC 0AC0 or al, al :0040CCDE 7412 je 0040CCF2 :0040CCE0 8A4101 mov al, byte ptr [ecx+01] :0040CCE3 3A4201 cmp al, byte ptr [edx+01] :0040CCE6 7512 jne 0040CCFA :0040CCE8 83C102 add ecx, 00000002 :0040CCEB 83C202 add edx, 00000002 :0040CCEE 0AC0 or al, al :0040CCF0 75E4 jne 0040CCD6 * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CCDE(C) | :0040CCF2 33C0 xor eax, eax :0040CCF4 5E pop esi :0040CCF5 5B pop ebx :0040CCF6 83C404 add esp, 00000004 :0040CCF9 C3 ret Okay I have gathered the information in dasm that I want too now go and refer to in ice... We already know by working on and changing the jump at 00405C47 that a difinite true-false test is being performed; So now I am fairly confident that the call at 00405C3D will take me inside of some type of compare; calculation; or routine; that will return me to 00405C42, to begin a test of the compare inside of this call: :00405C3D E87E700000 call 0040CCC0 <<--- :00405C42 83C408 add esp, 00000008<<-return from call & :00405C45 85C0 test eax, eax <<--does eax = :00405C47 0F8434010000 je 00405D81<<-Yes equal? then jump; else.... :00405C4D 8B45E4 mov eax, dword ptr [ebp-1C] okay having used my f-8 key to step into this call; we arrive here: :0040CCC0 83EC04 sub esp, 00000004 <<---land here :0040CCC3 833D24F1420000 cmp dword ptr [0042F124], 00000000 :0040CCCA 53 push ebx :0040CCCB 56 push esi :0040CCCC 7537 jne 0040CD05 :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] :0040CCD2 8B542414 mov edx, dword ptr [esp+14] I'm not sure what several of these asm lines mean; but I step thru each line using my "d" key plus whatever the register value is on the line indicated to see what is held at that register...(example: d ebx; d esp+10; ect ) Note: SOMEtimes you must be on the line UNDER the line you want to look at because the register has not been loaded as yet. As in this case, if you want to see what is being held in the area of "ecx" you must be on the line below :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] (if i remember correctly) before typing ' d ecx ' because ecx register has not been loaded yet. You can see in the very top of the ICE window the area that shows the various registers and the values they are holding in them... when I land on :0040CCD2 8B542414 mov edx, dword ptr [esp+14] I type: d ecx I see in the data window on the right side...my FAKE # So I gather from this that esp+10 is where my fake # was being stored and it is now being put into ecx... Now look to the line when I land on :0040CCD2 8B542414 mov edx, dword ptr [esp+14] The same thing is happening here...esp+14 is holding our REAL serial and it is now being put into edx to do a compare with ecx...here :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] :0040CCD2 8B542414 mov edx, dword ptr [esp+14] * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:0040CCF0(C) | :0040CCD6 8A01 mov al, byte ptr [ecx]<<-move ecx into al :0040CCD8 3A02 cmp al, byte ptr [edx]<<-compare al to edx... :0040CCDA 751E jne 0040CCFA<<--if not equal then jump to 0040CCFA Well we see now that #1 ecx is holding Fake # #2 edx is holding REAL # #3 ecx is being compared to edx #4 are they the same? No! Then jump... Well; is there a way to make them both the same? Yes...heres how... notice in this line the "#10" at the end of the string, 8B4C2410 address: :0040CCCE 8B4C2410 <<-here mov ecx, dword ptr [esp+10] This #10 is the number 10 in [esp+10] Which we know holds a false serial now after typing 'd ecx' (no quotes). We know that [esp+14] holds the real one...(after typing 'd edx) so why don't we change the [esp+10] to read [esp+14] instead...in this way when the check cmp is done at the code below it will now be loading the REAL serial into ecx instead of the Fake #; and then this change will now compare the real serial now in ecx, with the real serial in edx...here: :0040CCD6 8A01 mov al, byte ptr [ecx]<<-move ecx into al :0040CCD8 3A02 cmp al, byte ptr [edx]<<-compare al to edx... :0040CCDA 751E jne 0040CCFA<<--Are they now the same after the change? Yes... So this is how a newby can change the value of this address: Because it is the line 0040CCCE 8B4C2410 mov ecx, dword ptr [esp+10] that you wish to edit simply type: (e=edit) e 0040ccce (enter key) we are telling ice we want to edit address 0040CCCE. When you hit the (enter key)... Your data box will now look similar to this (with lots of numbers in coloumns) look to this first line horizontaly... ..............................byte.................. 0157:0040ccce...8b..4c..24..10..8b..54..24..14..-..8a..01..ect ect This is the address we want to change: 8B4C2410 ...See the number 10 above? this is what we will change to a '14'. after typing: e 0040ccce (enter key) You will now see your mouse cursor has landed on and is blinking on the number '8' in this line: ..............................byte.................. 0157:0040ccce...8<< now use your arrow key to move to the right til you get to the '10'. Change the '10' by typeing the number '14' over the top of the '10'. hit your enter key and this will be executed and changed... Now the code will look like this: :0040CCC0 83EC04 sub esp, 00000004 :0040CCC3 833D24F1420000 cmp dword ptr [0042F124], 00000000 :0040CCCA 53 push ebx :0040CCCB 56 push esi :0040CCCC 7537 jne 0040CD05 :0040CCCE 8B4C2410 mov ecx, dword ptr [esp+14]<<-here; no longer a 10 :0040CCD2 8B542414 mov edx, dword ptr [esp+14] Now when the check is done here: :0040CCD6 8A01 mov al, byte ptr [ecx]<<-move ecx into al :0040CCD8 3A02 cmp al, byte ptr [edx]<<-compare al (ecx) to edx... :0040CCDA 751E jne 0040CCFA<<--Are they now the same? Yes... The ecx and edx will indeed be the same.......without having to change any conditional jumps anywhere else in the program because all checks after this change will also indeed now be 'True' Now some will say alot of work was done when you could have simply wrote down the REAL Serial... exited Ice... and typed it in and Wha-la...done...This is true...but...we are here to learn how to "DE-Bone" these things in many and various ways and this is just one more... Hope this helped to demonstrate how to make some changes in ICE to those of you who haven't worked it out yet on just how to make changes in the edit mode using Ice...or why... Regards Jeff Jeff (jas) |
Jeff: jas's Thread for NEW newbys (05-Feb-99 21:20:24) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.