CrackMe Practices for Newbies ~ Moderated

Re: Re: Partial calculation (a little more on length)
Sunday, 24-Jan-99 20:35:14
    206.248.47.178 writes:

    Length Routine is quite complex and there seems to be more than one area involved. The routines below are spread over some length I have only printed the pertinent lines. I have commented the lines. Hopefully this will be helpful.



    We start here :00412E06 E84D070000 call 00413558

    004135C8 A128404100 mov eax, dword ptr [00414028] … This is the thank you string put into eax

    * Reference To: MSVBVM50.rtcMsgBox, Ord:0253h
    |
    :004135F4 E85DDCFEFF Call 00401256 .. print messagebox thank you for registering on screen or if wrong serial the messagebox with the sorry message, whatever is loaded at 4135C8


    * Reference To: MSVBVM50.__vbaStrCmp, Ord:0000h
    |
    :00413633 E80CDCFEFF Call 00401244 compare the strings
    :00413638 85C0 test eax, eax …………if they're the same eax=0 otherwise eax=ffffffff
    :0041363A 0F853E020000 jne 0041387E


    004136A2 DD054C404100 fld qword ptr [0041404C] …. # from calc routine at 413323

    * Reference To: MSVBVM50.__vbaFpI2, Ord:0000h
    |
    :004136A8 E891DBFEFF Call 0040123E
    :004136AD 50 push eax

    -------------------------------------------------------------from VMSVBVM50

    Exported fn(): __vbaFpI2 - Ord:0076h
    :0F1021C9 D9FC frndint …………………….Round number to integer
    :0F1021CB 83EC04 sub esp, 00000004
    :0F1021CE DF1C24 fistp word ptr [esp] ……… put integer in address of pointer
    :0F1021D1 DFE0 fstsw ax …………………… set flags
    :0F1021D3 A80D test al, 0D
    :0F1021D5 0F85CB7F0000 jne 0F10A1A6
    :0F1021DB 58 pop eax
    :0F1021DC C3 ret

    from MSVBVM50 -------------------------------------------------------------

    00413700 8B854CFFFFFF mov eax, dword ptr [ebp+FFFFFF4C]
    :00413706 8B00 mov eax, dword ptr [eax]
    :00413708 FFB54CFFFFFF push dword ptr [ebp+FFFFFF4C]
    :0041370E FF909C000000 call dword ptr [eax+0000009C]….call checks for length puts result in eax
    :00413714 898548FFFFFF mov dword ptr [ebp+FFFFFF48], eax
    :0041371A 83BD48FFFFFF00 cmp dword ptr [ebp+FFFFFF48], 00000000 …if eax =0 then proper length
    :00413721 7D23 jge 00413746 ………………………………if eax =0 then jump and continue
    :00413723 689C000000 push 0000009C ………………………..Otherwise prepare
    :00413728 6844164100 push 00411644
    :0041372D FFB54CFFFFFF push dword ptr [ebp+FFFFFF4C]
    :00413733 FFB548FFFFFF push dword ptr [ebp+FFFFFF48]

    * Reference To: MSVBVM50.__vbaHresultCheckObj, Ord:0000h
    |
    :00413739 E8CADAFEFF Call 00401208 ………………………And jump back to cleared input screen, do not deactivate
    :0041373E 898528FFFFFF mov dword ptr [ebp+FFFFFF28], eax
    :00413744 EB07 jmp 0041374D


    Princess


    Princess


Message thread:

Princess' Tread... (Princess) (20-Jan-99 22:35:29)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © ProSoft 1997-1998
All rights reserved.