Posted by ShADe on 1/22/2000, 1:26 am
, in reply to "Cray_Z's task ---2--- answers so far..."
203.57.68.10
Hi there Cray_Z Haque has already covered some of this but I wrote it so i'll paste it.
I think your references must be off a little, I tried looking up the jump e you
mention at :00446efc but I don't have a jump here or anywhere about it??.Finding the serial with W32Dasm. Although its not the best tool for the job it
can be used and with a fairly simple program like this it is not to bad. I don't
have softice loaded on this machine and have been to lazy to copy the program to
my other so I have done the whole thing is W32Dasm so far. Here is how to get
near the serial number with W32Dasm.Taking it that you have already isolated the serial checking routine with your
deadlisting and you know where abouts you want to look for your number.(ie the
lstrcmpA routine)Make a note of a line number where you want to break. Somewhere just above the
checking routine.
After opening the program in W32Dasm Menu-Debug/Load Process wait till W32dasm
has finsished loading everything then Menu-Goto/Goto Code Location. In the box
type the address you noted earlier.
When you are at the line you want to break on press F2 this will place a little
yellow box to the left of the line, this is a breakpoint. To see all the
breakpoints you have set look in the middle sized window on the right in the
middle edit box. You can enable and disable the breakpoints by selecting the one
you want then right clicking it.
Ok now press F9 to run the program. As the program tests the reg# at startup
W32Dasm will break at your breakpoint.The little box in the top right of the
register window (middle sized one) shows whether the program is running or
paused.
When it breaks (pauses) maximize and click the main W32Dasm window and you will
see the line with your BPX. Press F7 to move through the program and F8 to jump
over any calls you don't wish to follow.
When you get to where you want to inspect for your serial number, in the
register window click the button with the register you wish to check and its
value will be displayed in the center window.
This center window will show you the value which is stored at for example ecx.If
the value at ecx is a reachable address the window below this will show the
value stored at the address pointed to by the address, pointed to by ecx. Deep
breath hope this makes sense :-)You can also add in two of your own address watches (ie dw 0075F5E4 in softice)
in the two small edit boxes on the left hand side of the window. When you have
entered a value click the UA1 or UA2 buttons to display these memory locations.Another really useful feature of W32Dasm is its API window. In the small
untitled window select 'enable undocumented api details' and 'auto stop on api'
now from your breakpoint continue using F8 to step through your program. While
you will jump all calls you will be shown a window containing all the parameters
of the call and by pressing 'Get API result' you will also see the results of
the call. You can get some very useful information from these windows ;-)You can modify data in the registers and memory as you would in softice using
the 'Modify Data' button at the bottom of the window.
You can patch new code (a eip in softice) using the other small window. Using
the 'goto address' button on this window to goto the line you want to modify.
(Note this goto is different than the one in the main window) When the line you
want to modify is in view in the small window press the 'patch code' button.
Type the instructions as you would in softice pressing return after each one
then 'apply patch' to insert them.As for your softice problems you should try asking on the +Sandmans board but
give as much specific info as you can. For instance the operating sys you are
using, the version of softice and any errors etc you get.Hope some of this helps
ShADė