home *** CD-ROM | disk | FTP | other *** search
/ Cracking 2 / Cracking II..iso / Texty / crackme / n0p3x-2a_tut.txt < prev    next >
Encoding:
Text File  |  1999-06-15  |  2.0 KB  |  75 lines
  1. Tutorial for nOp3x v2a
  2. by Sanhedrin
  3.  
  4. Tools
  5. Wdasm
  6.  
  7.  
  8. The quick 2 step method of cracking without softice.
  9.  
  10. Step 1
  11.  
  12. Disassemble the crackme and go to the program's entry point.  A few 
  13. lines down you will notice:
  14.  
  15. * Reference To: USER32.DialogBoxParamA, Ord:0000h
  16.                                   |
  17. :0040101D E82B010000              Call 0040114D<---call the nag screen
  18. :00401022 E911010000              jmp 00401138<---end program
  19. :00401027 C8000000                enter 0000, 00
  20. :0040102B 817D0C11010000          cmp dword ptr [ebp+0C], 00000111
  21.  
  22. So we can't just NOP the nag screen, because the next line will kick us out of the program.
  23. Look a few lines further:
  24.  
  25. * Referenced by a (U)nconditional or (C)onditional Jump at Address:
  26. |:00401065(C)
  27. |
  28. :0040106B 6A00                    push 00000000
  29. :0040106D FF7508                  push [ebp+08]
  30.  
  31. * Reference To: USER32.EndDialog, Ord:0000h
  32.                                   |
  33. :00401070 E8E4000000              Call 00401159
  34. :00401075 6A00                    push 00000000
  35. :00401077 68BC104000              push 004010BC
  36. :0040107C 6A00                    push 00000000
  37. :0040107E 6A02                    push 00000002
  38. :00401080 FF3500204000            push dword ptr [00402000]
  39.  
  40. * Reference To: USER32.DialogBoxParamA, Ord:0000h
  41.                                   |
  42. :00401086 E8C2000000              Call 0040114D
  43. :0040108B 6A00                    push 00000000
  44. :0040108D FF7508                  push [ebp+08]
  45.  
  46. The jump reference at 0040106B originates from the 'take the program for a test drive...' button
  47. in the nag box.
  48.  
  49. Step 2
  50.  
  51. Therefore, just change the first call at 0040101D to jump to 0040106B and the NAG is gone.
  52.  
  53. 0040101D    E82B010000    Call 0040114D
  54.  
  55. to
  56.  
  57. 0040101D    EB4C    Jmp 0040106B
  58. 0040101F    90        NOP
  59. 00401020    90        NOP
  60. 00401021    90        NOP
  61.  
  62.  
  63.  
  64.  
  65. Greets to tC and BJanes (sorry I haven't gotten back to you, work has been crazy lately)
  66.  
  67. Thanks to all of those coders that make these crackmes, and of course to Eternal Bliss.
  68.  
  69.  
  70. Sanhedrin
  71. stachi@geocities.com
  72.  
  73.  
  74.  
  75.