Jeff's thread.... Wednesday, 20-Jan-99 18:37:53
Well; To begin with this won't be an easy in-easy out program; I will build on this thread as time permits and resolutions evolve...(heheheheh; evolutions disolve; oh-boy; got some green beer again.) What I find straight away is that the alt-f4 key works for this program... if you are not set-up with the Alt-f4 key then go here to see how it is done: http://www.proweb.co.uk/~greenway/Es59.html Softice should now display this code snippet:- : 56 push esi <<<---you land here; this is where you will set a new breakpoint. : 57 push edi : 8B7C2410 mov edi, [esp + 10] : 8B74240C mov esi, [esp + 0C] : 8B4C2414 mov ecx, [esp + 14] : 33C0 xor eax, eax : F366A7 repz cmpsw : 7405 je 0F79B362 : 1BC0 sbb eax, eax : 83D8FF sbb eax, FFFFFFFF : 5F pop edi : 5E pop esi : C20C00 ret 000C clear other breakpoints: double click on line Of00d9ea:: 56 push esi <<<---you land here; now when you pop back to ice f-10 down to line: : 8B4C2414 mov ecx, [esp + 14] You will see that your esi register is highlighted...and is holding the number 0042267c type 'd esi' (no quotes) You will see in your data box the words: "Sorry, invalid code!" your edi register and your ecx register hold the values of 00411600... type: d ecx Your data window will state: "Thank you for registering" I believe this to be our good code at this moment; I believe since it does not register this crackme that an additional compare or xor must be happening somewhere that will convert Thank you for registering into a valid regester key... I have not found it yet; if so... By studying it; a number of things croped up: There is a line which states; BERSERK!?!? Each and EVERY compare hold the two values explained above: "Thank you for registering" & "Sorry, invalid code!" I simply do not have the experience to figure it out thus far... And it gets very complicated from here: at this point in the code : 56 push esi : 57 push edi : 8B7C2410 mov edi, [esp + 10] : 8B74240C mov esi, [esp + 0C] : 8B4C2414 mov ecx, [esp + 14] <<--d esi= I think bad code; d ecx= I think good code : 33C0 xor eax, eax : F366A7 repz cmpsw : 7405 je 0F79B362 : 1BC0 sbb eax, eax : 83D8FF sbb eax, FFFFFFFF : 5F pop edi : 5E pop esi : C20C00 ret 000C Here s where it gets complicated; if you now type 'x' to leave; box is now empty...(why?) re-type your input and clcick unlock...The error Sorry box pops; clcik okay and ice will pop back; we can now do a second check in this area...you will find this second trip into this break that things in your register box are changed; different numbers....hummmmm...and when you pass : 33C0 xor eax, eax : F366A7 repz cmpsw <<<--pass here compare : 7405 je 0F79B362 you will see that your registers have new values in them...and that by now typing 'd' ecx and esi ...well; it would now seem that the letter "T" is being compared with the letter "S" of Sorry; and because when you dump the registers they now look like this: hank you for registering" orry, invalid code!" I can see its comparing the "T" with the "S" but so far can not put it together... and what of BERSERK!?!?! I mentioned earlier......??? I have searched the code and could not find a xor routine yet; nor any mention of BERSERK!?!? nor have I seen any error screens yet that state: "What ya looking at BoZo!?!?"...so I wonder what this has to do with this also.... Just kinda putting my thoughts and direction together here.... Will continue later Regards Jeff Jeff |
Jeff's thread.... (Jeff) (20-Jan-99 18:37:53) |
|
Copyright © ProSoft 1997-1998
All rights reserved.