![]() | |
Re: YEP!!!!!, I FOUND something! ;) Monday, 25-Jan-99 09:56:53
Hi EB, Yep, YOU CAN DO THAT! :) You must change "Thanks..." to "Sorry..." and 2(32h) to 28h! It must look like this: ----------------------------------------------------- ...28000000 (... 53006F007200720079002C0020006900 S.o.r.r.y.,. .i. 6E00760061006C006900640020006300 n.v.a.l.i.d. .c. 6F006400650021... o.d.e.! ----------------------------------------------------- After(or before??) program stores "Thanks"/"Sorry" into memory it stores one number in front of message! For "Sorry" it's 28, for "Thanks" it's 32! You can see that first hardcoded "Thanks.." has 2(32h) in front! Then program(unpatched) compares 28h/32h with 32h("Thanks...") if they are same(Both 32(Thanks)) program goes to compare strings themselves! ...I just discover how program puts 28h/32h into memory! It takes lenght stored one byte in front the hardcoded string, for "Thanks" it's 19, for "Sorry" it's 14! Then it shifts the lenght by one (SHL lenght,1) and substract 1 from the result! Here is the example: "Thanks..." - lenght 19 SHL 19, 1 - it's same as 19*2^1 Result is 33 -- 33 - 1 is ///32/// <=== That's hex value of number stored in front of first hardcoded "Thanks" string, isn't it? --- CHR -> "2" Now when we know this we can little play with messages... :) Change "Sorry..." to "Bjanes" ;) Just one byte in front the "Bjanes" string put it's lenght, that's 6(06h) Now find first hardcoded "Thanks..."; Change it to "Bjanes"! Locate number 2(32h) in front of the string! Let's now make new number... SHL 6,1 --> 6*2^1 = 0Dh...ODh - 1 = 0Ch (I think ;) Put 0Ch instead of 32h and save the file! Run the program and type into any BAD SERIAL! Message "Bjanes" appears and program is DEACTIVED!!!! You can also change second hardcoded "Thanks..." on the same way and then even you put correct serial(or bad) program will highlight DEACTIVED!!...Cool... Use your imagination :) PS EB,I think that my crackme is uncrackable ;(...must change it a little :) PS2 ...hope you all understand what I try to explain(I give best from myself) :) ...Also sorry for bad English bye, Borna bjanes |
Solved it!!! (EB) (23-Jan-99 20:10:43) |
|
Copyright © ProSoft 1997-1998
All rights reserved.