CrackMe® Practices for Newbies ~ Moderated

Jeff's thread....
Wednesday, 20-Jan-99 18:37:53
    209.142.46.47 writes:

    Well;
    To begin with this won't be an easy in-easy out program;

    I will build on this thread as time permits and resolutions evolve...(heheheheh; evolutions disolve; oh-boy; got some green beer again.)

    What I find straight away is that the alt-f4 key works for this program...

    if you are not set-up with the Alt-f4 key then go here to see how it is done:

    http://www.proweb.co.uk/~greenway/Es59.html



    Softice should now display this code snippet:-

    : 56 push esi <<<---you land here; this is where you will set a new breakpoint.
    : 57 push edi
    : 8B7C2410 mov edi, [esp + 10]
    : 8B74240C mov esi, [esp + 0C]
    : 8B4C2414 mov ecx, [esp + 14]
    : 33C0 xor eax, eax
    : F366A7 repz cmpsw
    : 7405 je 0F79B362
    : 1BC0 sbb eax, eax
    : 83D8FF sbb eax, FFFFFFFF
    : 5F pop edi
    : 5E pop esi
    : C20C00 ret 000C

    clear other breakpoints: double click on line Of00d9ea:: 56 push esi <<<---you land here;

    now when you pop back to ice f-10 down to line:

    : 8B4C2414 mov ecx, [esp + 14]


    You will see that your esi register is highlighted...and is holding the number 0042267c

    type 'd esi' (no quotes) You will see in your data box the words:
    "Sorry, invalid code!"

    your edi register and your ecx register hold the values of 00411600...

    type:
    d ecx
    Your data window will state:
    "Thank you for registering"

    I believe this to be our good code at this moment; I believe since it does not register this crackme that an additional compare or xor must be happening somewhere that will convert Thank you for registering into a valid regester key...

    I have not found it yet; if so...

    By studying it; a number of things croped up:

    There is a line which states;

    BERSERK!?!?

    Each and EVERY compare hold the two values explained above:
    "Thank you for registering"
    &
    "Sorry, invalid code!"

    I simply do not have the experience to figure it out thus far...

    And it gets very complicated from here:

    at this point in the code
    : 56 push esi
    : 57 push edi
    : 8B7C2410 mov edi, [esp + 10]
    : 8B74240C mov esi, [esp + 0C]
    : 8B4C2414 mov ecx, [esp + 14] <<--d esi= I think bad code; d ecx= I think good code
    : 33C0 xor eax, eax
    : F366A7 repz cmpsw
    : 7405 je 0F79B362
    : 1BC0 sbb eax, eax
    : 83D8FF sbb eax, FFFFFFFF
    : 5F pop edi
    : 5E pop esi
    : C20C00 ret 000C

    Here s where it gets complicated; if you now type 'x' to leave; box is now empty...(why?) re-type your input and clcick unlock...The error Sorry box pops; clcik okay and ice will pop back; we can now do a second check in this area...you will find this second trip into this break that things in your register box are changed; different numbers....hummmmm...and when you pass

    : 33C0 xor eax, eax
    : F366A7 repz cmpsw <<<--pass here compare
    : 7405 je 0F79B362

    you will see that your registers have new values in them...and that by now typing 'd' ecx and esi ...well; it would now seem that the letter "T" is being compared with the letter "S" of Sorry; and
    because when you dump the registers they now look like this:

    hank you for registering"
    orry, invalid code!"

    I can see its comparing the "T" with the "S"
    but so far can not put it together...

    and what of BERSERK!?!?! I mentioned earlier......???

    I have searched the code and could not find a xor routine yet; nor any mention of BERSERK!?!? nor have I seen any error screens yet that state:
    "What ya looking at BoZo!?!?"...so I wonder what this has to do with this also....

    Just kinda putting my thoughts and direction together here....

    Will continue later

    Regards
    Jeff

    Jeff


Message thread:

Jeff's thread.... (Jeff) (20-Jan-99 18:37:53)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © ProSoft 1997-1998
All rights reserved.