![]() | |
Re: Reading dat file Friday, 29-Jan-99 21:01:31
A few things I have noticed When the crackme reads the dat file it has already changed four locations 40204B has become 0D and 40204C has become 0A This is before the file does anything with the characters. At location 401044 as soon as it returns from readfile. Also locations 40205D has become 0D and 40205E has become 0A These characters are put in shifting the strings to the right. This would seem that the last four bytes are not used. Not all 16 characters are read at a time First call at 401116 reads 12 characters, 4 loops at three characters a loop. This changes the characters in string 1. Then the next 4 characters are read at 40108D The next time we go to 401116 15 characters are read, 5 loops at three characters a loop. Then when we go through call at 4011C1 there is more manipulation of string two The last string is not written over or changed ( at least not until the cmp eax when it recognizes the file is wrong.) Princess Princess |
Princess's Tread (Princess) (29-Jan-99 15:08:40) |
|
Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.