CrackMe® Practices for Newbies ~ Moderated

Re: Re: Where prog saves bad/good message
Monday, 25-Jan-99 08:57:28
    195.29.234.236 writes:

    Hi,
    Just after that jump program saves bad/good message into memory
    Here is the code...

    BEFORE THIS IS CALC AND COMPARE ROUTINE!
    :00413388 7528 jne 004133B2 =>> BAD/GOOD JUMP
    :0041338A 833DAC44410000 cmp dword ptr [004144AC], 00000000
    :00413391 750F jne 004133A2
    :00413393 68AC444100 push 004144AC
    :00413398 681C144100 push 0041141C

    * Reference To: MSVBVM50.__vbaNew2, Ord:0000h
    |
    :0041339D E85ADEFEFF Call 004011FC

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:00413391(C)
    |
    :004133A2 8B35AC444100 mov esi, dword ptr [004144AC] -Prepare
    :004133A8 8D4DD8 lea ecx, dword ptr [ebp-28] -to
    :004133AB 51 push ecx -save

    * Possible Reference to String Resource ID=00001: "Thank you for registering"
    |
    :004133AC 6A01 push 00000001 -good code
    :004133AE 8B06 mov eax, dword ptr [esi] -into
    :004133B0 EB25 jmp 004133D7 -memory

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:00413388(C)
    |
    :004133B2 833DAC44410000 cmp dword ptr [004144AC], 00000000
    :004133B9 750F jne 004133CA
    :004133BB 68AC444100 push 004144AC
    :004133C0 681C144100 push 0041141C

    * Reference To: MSVBVM50.__vbaNew2, Ord:0000h
    |
    :004133C5 E832DEFEFF Call 004011FC

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:004133B9(C)
    |
    :004133CA 8B35AC444100 mov esi, dword ptr [004144AC] -Prepare to
    :004133D0 8D4DD8 lea ecx, dword ptr [ebp-28] -save
    :004133D3 51 push ecx -bad code
    :004133D4 57 push edi -into
    :004133D5 8B06 mov eax, dword ptr [esi] -memory

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:004133B0(U)
    |
    :004133D7 56 push esi -Save
    :004133D8 FF5030 call [eax+30] -it!
    :004133DB 85C0 test eax, eax
    :004133DD 7D0E jge 004133ED

    So you can nop jump at 413388, program will save "Thanks..." into mem,
    and DEACTIVED str will be highlighted!

    bye,

    Borna

    bjanes


Message thread:

Solved it!!! (EB) (23-Jan-99 20:10:43)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © ProSoft 1997-1998
All rights reserved.