Cracking Projects For Newbies

Project 6 - Task 2
Friday, 05-Feb-99 14:06:11
    129.27.200.50 writes:

    Solution for Task 2
    -------------------

    The 'Sorry....' message appears two times in the code at location 00405C50 and 0040B9BC.
    When you could manage that these strings are never displayed - and as aresult of that the program doesn't terminate with an invalid key, every registration code should be accepted.

    For location 00405C50 there are the following two statements just above
    00405C45 85C0 test eax,eax
    00405C47 0F8434010000 je 00405D81

    If you would change the 'jump equal' (je $0F84) to a 'jump not equal' (jne $0F85) location 00405C50 would never be reached and so no 'Sorry...' message.

    For position 0040B9BC things are a little bit more complicatet:
    Just above of the reference you find the following text:
    * Referenced by a (U)nconditional or (C)onditional Jump ad Address:
    |:0040B744(C)

    OK, thats what we find at location 0040B744:
    0040B742 85C0 test eax,eax
    0040B744 0F8572020000 jne 0040B9BC

    Again, changing the jne to a je would prevent from going right into the 'Sorry...' message.

    There is another very strange string reference: 'The program has been modified!'
    The program is probably CRC or md4/5 protected in some way.

    Nothing happend after patching (no CRC ????), the program can now be registered with what code ever. As far as I tested the program, there are no restrictions left.


    So the code had to patched at two locations. One location might be the location where the key from the registry is checked when the program starts. The other location might be the check ofter registering with the register-dialogue....


    After all, I'm not very happy with the result.....I removed the symptom but not the cause....and still i have no idea how the registration code is generated (yes, from the name, but how ?).

    What I've learned is, that patching is quite, easy (hmmmm.) quick and efficient but dirty..

    I had some trouble with HView when editing the ASM code instead of changing the opcodes...the destination addresses of the edited jumps changed in a very strange way -> the result was a page fault (softice came up itself, I didn't touch it Sandman !). I guess the reason for this is this BASE feature...no idea what it does. I also was not able to jump directly to the position given by w32dsm -> again this BASE behaviour...

    looking forward to the next task.....

    Microslave


Message thread:

Microslave: Project 6 -- Aren't You a little bit fast ? (03-Feb-99 04:57:18)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.