CrackMe® Practices for Newbies
CrackMe 2 by CyberBlade [ReFleXZ '99]

Re: can't break there
Friday, 16-Apr-99 21:36:02

    Hi EB,

    The address I gave you is inside the divide function, you may get there by bpx MSVBVM50!__vbaVarDiv. If you succeeed in breakin step throgh this function twice, There are 2 places inside this function where fdiv takes place. When you single step, eventually you will come to this address f0fe0e1 where you will see something like this

    0f0fe0e1 movsx edi word ptr[esi]
    add edi, ebp
    push edi
    call ebx

    put a bpx someplace before the call ebx and then x enter, the program will brea at this new break point many time. It is a good I dea to disable the other break points. Pay close attention to the adress in ebx and if you scroll a few line in the code window you will be able to see the names of the functions being called. Follow the three calls after the last call to __vbaVarDiv.
    That should be enough for now.
    I dont understand why SoftIce will not break for you at the address I gave you unless MSVBVM50 loads at a different location in your memory than mine.

    Best regards,

    Joseph


    Joseph


Message thread:

A bit of contribution (Eternal Bliss) (14-Apr-99 13:15:53)

Back to main board