Posted by MrEoUS on 1/29/2000, 12:21 pm
, in reply to "Task4.1"
128.109.131.47
Hello, again. Well, I have found the "bad guy message" is pushed to MessageBox routine at 0x4472cf. The message itself is at 0x49a157. This place seemed to me quite appropriate to store the correct serial. So I've just changed the destination string for sprintf from local string to this "bad guy message". In order to have opportunity to enter right serial after seeing it I had to change another one for lstrcmp. So the patches are:
lea eax, [ebp+RightSerial] -> lea eax, [badGuyMessage]
8d 85 a0 fe ff ff -> 8d 05 57 a1 49 00
and
lea ecx, [ebp+RightSerial] -> lea ecx, [badGuyMessage]
8d 8d a0 fe ff ff -> 8d 0d 57 a1 49 00
As you can see that's a 10 bytes solution :(.Regards, MrEoUS