home *** CD-ROM | disk | FTP | other *** search
- CrackMe #1 By AdrΘnalin
- -----------------------
- Tools Used:
- SoftIce
-
- ---
- Protection:
- Code
-
- ---
- First, you need to have MSVBVM50.DLL loaded in your S-ICE exports.
- Start the crackme, enter a code and set a breakpoint on __vbaStrCmp and
- press the OK button, when S-ICE breaks, press F11 and you'll land here:
-
- :00401D74 68541A4000 PUSH 00401A54
- :00401D79 FF1508314000 CALL [MSVBVM50!__vbaStrCmp]
- :00401D7F 8BF8 MOV EDI,EAX
- :00401D81 8D4DD8 LEA ECX,[EBP-28]
- :00401D84 F7DF NEG EDI
-
- do a 'd 401a54' and you'll see S.y.n.T.a.X. .2.o.o.1 and is in widechar because
- the program is written in VB, so the string is SynTaX 2oo1
- Enter that, and we have cracked the crackme :)
- ---
- /Klefz - http://klefz.cjb.net