CarLitoZ bPe CrackMe v1.0
Visual Basic 5
Written by McCodEMaN

Numega SmartCheck v6.x
Numega SoftIce v3.2x

http://crackmes.cjb.net

 
First Approach: Using SmatCheck!
 

Step1 Run Smartcheck and configure the settings, like this:

      Under Program/settings menu:

     *ERROR DETECTION: Check all boxes except 'Report errors immediately'

     *ADVANCED SETTINGS: Check the first four boxes. The others should be emty!

     *REPORTING: All boxes should be checked except the one for:
                                'Report Mouse Move events from ocx controls'
 
 
 

Step2 OK, now you are ready to fight!
 
 

Step3 Load bPe CrackMe.exe by click 'File' and 'Open', => open bPe CrackMe1.exe!
 
 

Step4 Run Bpe_cme1.exe in SmartCheck by pressing F5 or by pressing the runbuttom in the
          toolfield.
 
 

Step5 Ok, now you are going to type in a fake serial, i use: 1234567890,
         the program validates the serial and tell you that it was wrong.
         Now terminate bPe CrackMe1.exe by clicking on the stop buttom.
 
 

Step7 Ok, open:  Reg_Click by clicking the  ' + ' sign.
         This is a subroutine in Visual Basic that is called when you press the register buttom.
 
 

Step8 Go down to Text .Text and make sure its highlighted!
         Then choose: show all events under view
 
 

Step9 Now you should be able to see:
 
 Text . Text
 Mid
 Mid
 Mid
 Mid
 Mid
 Mid
 Mid
 Mid
 __vbaVarAdd   returns  DWORD:63F260
 
 Now, if you go to the first __vbaVarAdd you will see some inf in the right window and you will see:

                    örö <= The first char in our valid serial

                    ökö <= The second char in serial
 

        __vbaVarAdd  returns  DWORD:63F220 <= örkö  and add öhö          (add  variant to  string)

        __vbaVarAdd  returns  DWORD:63F1E0 <= örkhö and add ö1ö

        __vbaVarAdd  returns  DWORD:63F1A0 <= örkh1ö and add öoö

        __vbaVarAdd  returns  DWORD:63F160 <= örkh1oö and add öyö

        __vbaVarAdd  returns  DWORD:63F120 <= örkh1oyö and add öiö

        __vbaVarAdd  returns  DWORD:63F0E0 <= örkh1oyiö and add öeö

        __vbaVarTstEg  returns  DWORD:0 <= örkh1oyieö                                   (cmp two strings)
 
 

Step9 The fake serial can be found two strings down at: SysFree string => 1234567890 and the
          valid serial are once again exposed at the next string!
 
 
 

Second Approach: Using SoftIce!
 

Step1 Run bPe CrackMe1.exe and type in a fake seial.
 

Step2 Fireup SoftIce and place a bp on bpx__vbastrcomp, then return to bPe.exe and press
         [Register] and softice breaks due to MSVBVM50!__vbastrComp.
         Please note: after bpx comes two underscores!
 

Step3 F10 down to......

                 :0F003577      MOV   ESI , [EAX - 04]
 
          EAX = Fake serial!
 
 

Step3 Trace down to.......

                  :0F003588      MOV   EDI , [ECX-04]

          d  ecx-04 => .r.k.h.1.o.y.i.e. ( In wide char)
 
 
 

Ok,..... this CrackMe is Cracked!

I would like to thank:

Razzia, for making me interested in VB in the first place!
Jeff, for making me come back to the VB environment after a long vacation!
Eternal Bliss, for providing us with a great VB source!