CrackMe® Practices for Newbies ~ Moderated

Ok I have done it. Now someone explain how i did please:)
Thursday, 21-Jan-99 06:29:28
    203.46.70.114 writes:

    I ran the program to see what error messages come up etc and then used w32Dasm to get some
    breakpoints. I set a Bp on vbastrvarval as I thought that might be an interesting Bp cause I
    guess it stands for string variable value? dunno if it does but it sounds right to me:)
    I typed in 111222 and then set the Bp then pressed the unlock button.
    I traced for about an hour all over the place and set breakpoints on the serial or at least
    where I thought the serial was and finally ended up here.

    If you want to get to here set a Breakpoint on __vbalenBstr "note: 2 underscores not one"
    Type in your serial, set the breakpoint and then press the unlock button. press g once and then
    f12 and then you should be here.

    CALL MSVBVM50!__vbaLenBstr
    IMUL EAX,EAX,0000029A
    MOV [EBP-009C],EAX Eax=length of bogus serial
    PUSH DWORD PTR [EBP-18] d ebp-18 in my case = 4c2d42 so d 422d4c=bogus serial in widechar
    FILD DWORD PTR [EBP-009C]
    FDIV REAL8 PTR [00401060]
    FDIV REAL8 PTR [00401068]
    FSUB REAL8 PTR [00401070]
    FSUB REAL8 PTR [00401078]
    FSTP REAL8 PTR [0041403C]
    FLD REAL8 PTR [EBP-20]
    FDIV REAL8 PTR [00401080]
    FMUL REAL8 PTR [00401088]
    FSTP REAL8 PTR [00414044]
    CALL MSVMVB50!__vbaLenBstr
    IMUL EAX,EAX,0000014D
    MOV [EBP-00A0],EAX
    FILD DWORD PTR [EBP-00A0]
    FDIV REAL8 PTR [00401060]
    FDIV REAL8 PTR [00401068]
    FSUB REAL8 PTR [00401070]
    FSUB REAL8 PTR [00401078]
    FSUB REAL8 PTR [00401090]
    FSTP REAL8 PTR [0041404C]
    FLD REAL8 PTR [00414044]
    FCOMP REAL8 PTR [00401098] THIS IS THE COMPARE :)
    FSTSW AX
    SAHF
    JNZ 004133B2 Change this to JZ and you can type anything in and its registered



    Now obviously the FCOMP is a compare and I know that real8 stuff plays with the maths co
    processor i think. If you type "WF" without quotes in Softice it displays the
    co-pro? registers? and you can see various values being played with.
    I have no idea what half of these commands are so I hope that some of you guys can enlighten me.
    Please :)
    Pedro



    Pedro


Message thread:

Pedros Thread (n/t) (21-Jan-99 06:26:03)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © ProSoft 1997-1998
All rights reserved.