CrackMe® Practices for Newbies ~ Moderated

a bit of contribution
Thursday, 21-Jan-99 17:01:28
    195.147.140.142 writes:

    Hi,
    since I know I am totally wrong in my hypothesis, I might as well look at others... 8)
    I used "1" as the code for example. It is converted to 49 (usual for VB programs)
    I have cut away some parts to keep it short(?). Here is what I found...

    :004132BC DB8568FFFFFF fild dword ptr [ebp+0098] < 49 is pushed to ST(0)
    :004132C2 DC4DE0 fmul qword ptr [ebp-20] < multiplied by 2
    :004132C5 DD5DE0 fstp qword ptr [ebp-20] < Stored in ebp-20

    If I enter 12, 49 is pushed in the first round as above to [ebp-20]

    Then on the second round, 2 (converted to 50) is pushed and multiplied by 98 which is in [ebp-20] to get 4900 and is stored back in [ebp-20] before going to below for further processing...

    --------snip------------

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:0041326F(C)
    |
    :004132E2 DD45E0 fld qword ptr [ebp-20] < push 98 to ST(0)
    :004132E5 DC3558104000 fdiv qword ptr [00401058] < divide by 10
    :004132EB FF75E8 push [ebp-18]
    :004132EE DD5DE0 fstp qword ptr [ebp-20] < store at ebp-20

    * Reference To: MSVBVM50.__vbaLenBstr, Ord:0000h
    |
    :004132F1 E8EEDEFEFF Call 004011E4 < get length of code eg 1
    :004132F6 69C09A020000 imul eax, 0000029A < length of code X 666 = 666
    :004132FC 898564FFFFFF mov dword ptr [ebp+009C], eax < store at ebp+009C
    :00413302 FF75E8 push [ebp-18]
    :00413305 DB8564FFFFFF fild dword ptr [ebp+009C] < 666 pushed to ST(0)
    :0041330B DC3560104000 fdiv qword ptr [00401060] < divide by 8
    :00413311 DC3568104000 fdiv qword ptr [00401068] < divide by 60
    :00413317 DC2570104000 fsub qword ptr [00401070] < -(-2) = +2
    :0041331D DC2578104000 fsub qword ptr [00401078] < -0.325
    :00413323 DD1D3C404100 fstp qword ptr [0041403C] < store at 41403c
    :00413329 DD45E0 fld qword ptr [ebp-20] < 9.8 push to ST(0) again
    :0041332C DC3580104000 fdiv qword ptr [00401080] < divide by 6780496716
    :00413332 DC0D88104000 fmul qword ptr [00401088] < multiple by 3
    :00413338 DD1D44404100 fstp qword ptr [00414044] < store at 414044

    * Reference To: MSVBVM50.__vbaLenBstr, Ord:0000h
    |
    :0041333E E8A1DEFEFF Call 004011E4 < get length of code eg 1
    :00413343 69C04D010000 imul eax, 0000014D < length of code X 333 = 333
    :00413349 898560FFFFFF mov dword ptr [ebp+00A0], eax < store at ebp+00A0
    :0041334F DB8560FFFFFF fild dword ptr [ebp+00A0] < 333 pushed to ST(0)
    :00413355 DC3560104000 fdiv qword ptr [00401060] < divide by 8
    :0041335B DC3568104000 fdiv qword ptr [00401068] < divide by 60
    :00413361 DC2570104000 fsub qword ptr [00401070] < -(-2) = +2
    :00413367 DC2578104000 fsub qword ptr [00401078] < -0.325
    :0041336D DC2590104000 fsub qword ptr [00401090] < -0.8375
    :00413373 DD1D4C404100 fstp qword ptr [0041404C] < store at 41404C
    :00413379 DD0544404100 fld qword ptr [00414044] < load value from above to ST(0)
    :0041337F DC1D98104000 fcomp qword ptr [00401098] < compare to 72
    :00413385 DFE0 fstsw ax
    :00413387 9E sahf
    :00413388 7528 jne 004133B2
    :0041338A 833DAC44410000 cmp dword ptr [004144AC], 00000000
    :00413391 750F jne 004133A2


    EB


Message thread:

Jeff's thread.... (Jeff) (20-Jan-99 18:37:53)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © ProSoft 1997-1998
All rights reserved.