Re: On the edge...hope this helps Wednesday, 24-Feb-99 18:25:40 Hi EB. I will try to see if I can explain my steps. At first I opened up Win-eXpose IO to see what files were accessed. And here the program is looking for caveman.dat so I created it and filled it with some bytes (any bytes about 500) I noticed in Win-eXpose it was looking for two bytes. Through trail and error I notice the number in these two bytes are the length it reads from the dat file. I put a bpint 21 if (ah ==3f) so Ice will break, which it does the first time it reads the .dat file at 0122 and single step keeping an eye on the code to see if the cmp's are passed. That is how I found that the first two bytes were the length of the user name and that the two bytes were reversed. At location 016C - 0175 a checksum of the username is made and compared to [065A] at 0177 If these two bytes are not the same as in your dat file change your .dat file after your user name to whatever is in [065A] at 0177 (reverse order) My .dat file is like this 0B 00 50 72 69 6E 63 65 73 73 20 0D 0A 24 22 A1 …. Then 100 bytes… This will get be through all the checks until it checks the next 100 bytes. (it will write to the screen Registered to Princess) but will overwrite that when it checks the next 100 bytes. (Check with F4) At 019C - 01AF it decrypts 100 bytes with the help of the 30 bytes from table at 01B1 - 01CD and the bytes at 660 - 666 These 100 bytes overwrites the bytes at the beginning of the program at 0100with new code ( a new created table) This alters the line numbering slightly. This is the puzzle board you will have to maneuver around with the help of the 100 (or less) bytes in your .dat file . It is really a puzzle board of 10 bytes times 10 bytes. This puzzle board is really difficult to see and follow if you look at the SoftIce screen. Copy the ascii characters to a piece of paper, 10 lines of 10 characters each. From here we jump to 053E where the last 100 bytes from our .dat file is put into 0667 and is manipulated in the next bit of code. You are given a starting point on this grid depending upon your user name. This is determined at 017F -018F At 01D0 this starting address is moved into si and if the code in that position is 2E then this is where you start, otherwise the pointer is incremented until it finds 2E which will then be your starting location. At 053E the 100 bytes from your .dat file is loaded into 0667 and then byte by byte you are moved around the board. Each byte moves your position 4 spaces depending upon ebx. (up,down,right or left) If ebx = 0 then you move up one position If ebx = 1 then you move down one position If ebx = 2 then you move left one position If ebx = 3 then you move right one position Each byte is rolled left 4 times and this determines how you move If your first number in your .dat file is 21 then the code at 0553 - 0588 ROL, AND, it then 21ROL al 02 becomes 84 which makes ebx =0 then 84 ROL al 02 becomes 12 which makes ebx =2 then 84 ROL al 02 becomes 48 which makes ebx =0 then 84 ROL al 02 becomes 21 which makes ebx =1 So you move one up, one left, one up, one down, Then you pick up the next number If you hit "T" you are booted out. It is like a puzzle where you have to move the blocks around. You can only move them if the spaces they will occupy has 2E Therefore if you move the aaa's you must have three spaces with 2e 2e 2e otherwise you cannot move. All three aaa's move in unison, either up, down, right or left You cannot move part of the block, only whole blocks and they have to be PUSHED so you need to make sure there is a 2e behind it, so you can get behind to push. Also if any part of the block is blocked by anything, you will not be able to move in that direction. Blocks cannot move on top of one another only into blocks with 2E which is considered an open space. Your goal is to end up on the "f" which will give you "Congratulations!" However if you land on the "w" you also get booted out and in order to get to the "f" you will have to remove the two ww which can be done by moving the cc on top of it (moving the cc to move on top of the ww will cause them to become 2E This will open the door (so to speak) and you may enter the f which makes you registered. So here is my .dat file 0B 00 50 72 69 6E 63 65 73 73 20 0D 24 22 A1 C0 25 AA A3 F8 3F 28 95 3F F5 6A AA 30 FF D4 2A A5 FE 83 FF 56 AF C0 AA A5 97 3F FD 63 2A FC 25 D8 A5 AA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 The 00 just fill up the 100 bytes and are unimportant CO = 3000 =right, up, up,up 25 = 0211 = up, left, down, down AA = 2222 = left, left, left, left Etc I hope this helps, Princess Princess |
Eternal Bliss' thread (Eternal Bliss) (23-Feb-99 17:49:18) |