CrackMe® Practices for Newbies ~ Moderated

Re: Jeff's Fresh Thread
Friday, 29-Jan-99 17:44:55
    209.209.30.85 writes:

    Well;
    first I was not able to get any response of a missing file in Winexpose!
    Lots of other files in red for crackme4; but nothing on a crackme.dat file...
    so; although Princess warned it did not work for her, I opened up filemon anyway just to see, and I had no problem with this crackme shutting it down..
    I have two instances of it looking for the crackme.dat....'not found'...but i see nowhere where it says its 30h or 48 bytes...

    Not following (understanding, yet)what U all are doing...I went to dasm.....and... did this:

    Searched for Incorrect....hoping that by changing the conditional jumps that it would auto matically Create and Write the crackme.dat file if it saw itself as Reged by changing the jumps....

    * Referenced by a (U)nconditional or (C)onditional Jump at Addresses:
    |:00401025(C), :004010A5(C), :004010B2(C) <<--these 3 conditions
    |

    * Possible StringData Ref from Data Obj ->"iNcORRECT fILE! :-P"
    |
    :004010E7 6800204000 push 00402000
    :004010EC 6A00 push 00000000
    :004010EE 6A0C push 0000000C
    :004010F0 FF3555224000 push dword ptr [00402255]

    * Reference To: USER32.SendMessageA, Ord:0000h
    |
    :004010F6 E89E070000 Call 00401899

    * Possible StringData Ref from Data Obj ->"iNcORRECT fILE! :-P"
    |
    :004010FB 6800204000 push 00402000
    :00401100 6A00 push 00000000
    :00401102 6A0C push 0000000C
    :00401104 FF3559224000 push dword ptr [00402259]

    * Reference To: USER32.SendMessageA, Ord:0000h
    ............................................................
    First condition comes here:
    At|:00401025(C)

    * Possible StringData Ref from Data Obj ->"CrkMe4.Dat"
    |
    :00401018 6828204000 push 00402028

    * Reference To: KERNEL32.CreateFileA, Ord:0000h
    |
    :0040101D E8CB080000 Call 004018ED
    :00401022 83F8FF cmp eax, FFFFFFFF
    :00401025 0F84BC000000 je 004010E7 <<<----jumps to Incorrct file
    :0040102B A333204000 mov dword ptr [00402033], eax
    :00401030 6A00 push 00000000
    :00401032 6837204000 push 00402037
    :00401037 6A30 push 00000030
    :00401039 683B204000 push 0040203B
    :0040103E FF3533204000 push dword ptr [00402033]


    Next is here:

    * Referenced by a (U)nconditional or (C)onditional Jump at Address:
    |:00401060(C)
    |
    :004010A2 83F800 cmp eax, 00000000
    :004010A5 7440 je 004010E7 <<--jumps to incorrect file
    :004010A7 90 nop
    :004010A8 90 nop
    :004010A9 90 nop
    :004010AA 90 nop
    :004010AB 803D4B20400000 cmp byte ptr [0040204B], 00
    :004010B2 7433 je 004010E7 <<----jumps to incorrect file; and next here
    :004010B4 90 nop
    :004010B5 90 nop
    :004010B6 90 nop
    :004010B7 90 nop

    * Possible StringData Ref from Data Obj ->" cORRECT !! :-)"
    |
    :004010B8 6814204000 push 00402014
    :004010BD 6A00 push 00000000
    :004010BF 6A0C push 0000000C
    :004010C1 FF3555224000 push dword ptr [00402255]



    Although; changing these three did pass me thru the 'correct' area above....it did not do anything for me.......like creating a file; ect.

    Back to the drawing board

    I'm off for a cup of brewsky and a peanut butter and mayonaise with red onions sandwhich...:)

    Jeff

    Jeff


Message thread:

Hummmm; None of can Post a thread...(Jeffs Thread) (Jeff) (29-Jan-99 14:12:06)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.