Posted by Cho on 1/17/2000, 4:38 pm
, in reply to "Task 2"
195.36.216.32
With Dasm I can't get the serial, so I have to use SoftIce. I start entering data in the registration box with a fake code and set a breakpoint with bpx hmemcpy. It breaks and I can see actually three calls Getdlgitemtexta at :0042CB2E, :0042CB63 and :0042CB8D corresponding to catching name, company and key code. I step down to look for the real code.
When I get to :00447294 call 00446A74, I realise that I'm actually in that interesting part between :00446E6F and :004472E4. So I step into that call. Here you'll find that the Name and Company you entered are processed (:00446B21 to :00446B43; :00446B52 to :00446B77) and get transformed into a code after the call at :00446B91.
A bit down you'll notice a call for lstrcmpa (string comparison). So just before that call, you can get your fade code and the real code at the addresses of edx and ecx. So AC200-47451 is the key code for Name: Pirate Copy and Company: xxx.
Going back to the deadlisting, you can see another patch for defeating the protection:
:00446B99 8D9510FFFFFF lea edx, dword ptr [ebp+FFFFFF10]
:00446B9F 52 push edx
:00446BA0 8D8DA0FEFFFF lea ecx, dword ptr [ebp+FFFFFEA0]
:00446BA6 51 push ecx
:00446BA7 E8AE460400 call 0048B25A --> comparisonIf you use the same string for comparison, the result should always be true. So what you can do is to change the address for edx or ecx:
at :00446B99 8D9510FFFFFF to 8D95A0FEFFFF
or at :00446BA0 8D8DA0FEFFFF to 8D8D10FFFFFF
or even at :00446BA6 51 to 52 (pushing twice edx)to make the two strings identical. You'll get registered for sure!