![]() | |
Re: Jeff's Fresh Thread Friday, 29-Jan-99 17:44:55
Well; first I was not able to get any response of a missing file in Winexpose! Lots of other files in red for crackme4; but nothing on a crackme.dat file... so; although Princess warned it did not work for her, I opened up filemon anyway just to see, and I had no problem with this crackme shutting it down.. I have two instances of it looking for the crackme.dat....'not found'...but i see nowhere where it says its 30h or 48 bytes... Not following (understanding, yet)what U all are doing...I went to dasm.....and... did this: Searched for Incorrect....hoping that by changing the conditional jumps that it would auto matically Create and Write the crackme.dat file if it saw itself as Reged by changing the jumps.... * Referenced by a (U)nconditional or (C)onditional Jump at Addresses: |:00401025(C), :004010A5(C), :004010B2(C) <<--these 3 conditions | * Possible StringData Ref from Data Obj ->"iNcORRECT fILE! :-P" | :004010E7 6800204000 push 00402000 :004010EC 6A00 push 00000000 :004010EE 6A0C push 0000000C :004010F0 FF3555224000 push dword ptr [00402255] * Reference To: USER32.SendMessageA, Ord:0000h | :004010F6 E89E070000 Call 00401899 * Possible StringData Ref from Data Obj ->"iNcORRECT fILE! :-P" | :004010FB 6800204000 push 00402000 :00401100 6A00 push 00000000 :00401102 6A0C push 0000000C :00401104 FF3559224000 push dword ptr [00402259] * Reference To: USER32.SendMessageA, Ord:0000h ............................................................ First condition comes here: At|:00401025(C) * Possible StringData Ref from Data Obj ->"CrkMe4.Dat" | :00401018 6828204000 push 00402028 * Reference To: KERNEL32.CreateFileA, Ord:0000h | :0040101D E8CB080000 Call 004018ED :00401022 83F8FF cmp eax, FFFFFFFF :00401025 0F84BC000000 je 004010E7 <<<----jumps to Incorrct file :0040102B A333204000 mov dword ptr [00402033], eax :00401030 6A00 push 00000000 :00401032 6837204000 push 00402037 :00401037 6A30 push 00000030 :00401039 683B204000 push 0040203B :0040103E FF3533204000 push dword ptr [00402033] Next is here: * Referenced by a (U)nconditional or (C)onditional Jump at Address: |:00401060(C) | :004010A2 83F800 cmp eax, 00000000 :004010A5 7440 je 004010E7 <<--jumps to incorrect file :004010A7 90 nop :004010A8 90 nop :004010A9 90 nop :004010AA 90 nop :004010AB 803D4B20400000 cmp byte ptr [0040204B], 00 :004010B2 7433 je 004010E7 <<----jumps to incorrect file; and next here :004010B4 90 nop :004010B5 90 nop :004010B6 90 nop :004010B7 90 nop * Possible StringData Ref from Data Obj ->" cORRECT !! :-)" | :004010B8 6814204000 push 00402014 :004010BD 6A00 push 00000000 :004010BF 6A0C push 0000000C :004010C1 FF3555224000 push dword ptr [00402255] Although; changing these three did pass me thru the 'correct' area above....it did not do anything for me.......like creating a file; ect. Back to the drawing board I'm off for a cup of brewsky and a peanut butter and mayonaise with red onions sandwhich...:) Jeff Jeff |
Hummmm; None of can Post a thread...(Jeffs Thread) (Jeff) (29-Jan-99 14:12:06) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.