Zap!s thread
Thursday, 18-Mar-99 17:01:57 Well... a new challenge... gotta like it. Get out W32dasm and other than a bunch of good-natured har-hars at me there wasn't much to be learned. Got a call to lstrcmpa - may be significant - Interesting, though, no calls to GetDlgItemText or GetWindowText - hmmm.... Break out msspy and run conquer - pop into Battle 1. First thing I noticed was that when you tab from the serial field to the OK button it doesn't tab properly - it jumps to the Cancel button - someone must be handling keyboard interrupt and didn't notice this glitch! Sure enough - hwnd conquer in sice gives us the handles to the edit controls but bmsg xxxx wm_gettext doesn't break when OK is pressed - very strange. And, seeing as how GetDlgItemText and GetWindowText are not even imports to conquer.exe, it's not surprising that neither of these breaks either. Time to have a martini and think a bit. Put a watch in msspy on the edit controls and the OK button (which, by the way, doesn't generate a WM_COMMAND when pressed :) Ah Ha! a bunch of WM_GETDLGCODE and WM_GETTEXTLENGTH messages. Ok. The text length is obviously important - So we set a bpx on lstrcmpa, put a name in that should satisfy a routine like this in the real worl, and keep incrementing the length of the serial. Finally at 22 chars it breaks! Check the pushed parameters to lstrcmpa and we find a 22 char code (blah blah-OEM blah blah) which when typed in gives us the good-guy msg. On to the next level. Zzzap@bigfoot.com |
Zap!s thread (Zzzap@bigfoot.com) (18-Mar-99 17:01:57) |