CrackMe® Practices for Newbies ~ Moderated

Re: Reading dat file
Friday, 29-Jan-99 21:01:31
    206.248.47.65 writes:

    A few things I have noticed

    When the crackme reads the dat file it has already changed four locations 40204B has become 0D and 40204C has become 0A
    This is before the file does anything with the characters. At location 401044 as soon as it returns from readfile.
    Also locations 40205D has become 0D and 40205E has become 0A These characters are put in shifting the strings to the right. This would seem that the last four bytes are not used.

    Not all 16 characters are read at a time
    First call at 401116 reads 12 characters, 4 loops at three characters a loop. This changes the characters in string 1.
    Then the next 4 characters are read at 40108D


    The next time we go to 401116 15 characters are read, 5 loops at three characters a loop.
    Then when we go through call at 4011C1 there is more manipulation of string two

    The last string is not written over or changed ( at least not until the cmp eax when it recognizes the file is wrong.)

    Princess



    Princess


Message thread:

Princess's Tread (Princess) (29-Jan-99 15:08:40)

Back to main board


Message subject:

Name: (optional)

Email address: (optional)

Type your message here:




Back to main board

Copyright © InsideTheWeb, Inc. 1997-1999
All rights reserved.