Posted by Joseph on 1/18/2000, 11:38 am
, in reply to "Task-2, One byte solution in II.5"
209.179.253.21
Greetings to all, I think that ALL one byte solutions which were posted thus far are FLOWED.
Here is why I think so:
Every one of these solutions which I read about including the one I originally posted, involves changing a byte or more within the sting compare operation. Some of them change a byte before the lstrcmpA function is called:.
Change 00446B99 8D9510FFFFFF Lea edx, dword ptr [ebp + FFFFFF10]
To 00446B99 8D51A0FEFFFF Lea edx, dword ptr [ebp + FFFFFFA0]
(In fact this one is a two byte sokution, but I included it here because is in the same catagory as the other three.)
and
Change 00446BA6 51 Push ecx
To 00446BA6 52 Push edx
Others change a byte after the return:
Change 00446BAE 0F94C0 Sete al
To 00446BAE 0F95C0 Setne al
and
Change 00446BB1 83E001 And eax, 00000001
To 00446BB1 83C801 Or eax, 00000001All the above patches work as far as the registration procedure are concerned, and all of them have the potential of giving the program the wrong information at the wrong time. What will happen when the program compares other strings which have nothing to do with registration? Of course the program will go to the wrong place and perform the wrong task. Do we want our programs to work this way? Absolutely not.
I think MrE Probably had something like this in mind when he poste his message "1 byte patch good but not good enough" commenting on hobgoblins solution--the first one listed above. Unwittingly I questioned MrE comment. Why did not MrE caution the rest of us when we made the blonder of not seeing the danger involved in this so called 'One byte solution'?Best regards,
Joseph